[SLES-16.0] Do not log the URL password in the "inst.install_url" boot parameter (bsc#1258701)

.github/workflows/ci-service.yml

@@ -57,6 +57,7 @@ jobs:
         distro: [ "tumbleweed" ]
 
     container:
+      # FIXME: use some 16.0 based image (with Ruby 3.4, TW contains Ruby 4.0...)
       image: registry.opensuse.org/yast/head/containers_${{matrix.distro}}/yast-ruby
 
     steps:
@@ -104,7 +105,9 @@ jobs:
         which
 
     - name: Install RubyGems dependencies
-      run: bundle config set --local with 'development' && bundle install
+      # install gems not included in Ruby 4.0
+      run: bundle config set --local with 'development' && bundle install && bundle add ostruct &&
+        bundle add cgi && bundle add fiddle
 
     - name: Check collecting translatable strings
       run: |

service/lib/agama/cmdline_args.rb

@@ -20,6 +20,9 @@
 # find current contact information at www.suse.com.
 
 require "logger"
+require "yast"
+
+Yast.import "URL"
 
 module Agama
   # This class is responsible for reading Agama kernel cmdline options
@@ -37,6 +40,20 @@ def initialize(data = {})
       @data = data
     end
 
+    def to_s
+      data_log = data
+
+      # optimization, hide the password only if it could be there
+      if data && data["install_url"] && data["install_url"].include?("@")
+        data_log = data.clone
+        data_log["install_url"] = Yast::URL.HidePassword(data["install_url"])
+      end
+
+      "#<#{self.class.name}:0x#{object_id.to_s(16).rjust(16, "0")} @data=#{data_log.inspect}>"
+    end
+
+    alias_method :inspect, :to_s
+
     def self.read
       read_from("/run/agama/cmdline.d/agama.conf")
     end

service/lib/agama/software/product_builder.rb

@@ -22,6 +22,9 @@
 require "agama/cmdline_args"
 require "agama/software/product"
 require "logger"
+require "yast"
+
+Yast.import "URL"
 
 module Agama
   module Software
@@ -75,7 +78,7 @@ def initialize_product(id, data, attrs)
       def set_repositories(product, data, cmdline_args)
         install_url = cmdline_args.data["install_url"]
         if install_url
-          @logger.info "agama.install_url is set to #{install_url}"
+          @logger.info "agama.install_url is set to #{Yast::URL.HidePassword(install_url)}"
           product.repositories = install_url.split(",")
         else
           product.repositories = data[:repositories]

service/lib/agama/software/repositories_manager.rb

@@ -21,6 +21,9 @@
 
 require "agama/software/repository"
 require "singleton"
+require "yast"
+
+Yast.import "URL"
 
 module Agama
   module Software
@@ -52,8 +55,8 @@ def reset
       # @param priority    [Integer] Repository priority, the lower number the higher (!)
       #                              priority, the default libzypp priority is 99
       def add(url, name: nil, repo_alias: "", autorefresh: true, priority: 99)
-        repositories << Repository.create(name: name || url, url: url, repo_alias: repo_alias,
-          autorefresh: autorefresh, priority: priority)
+        repositories << Repository.create(name: name || Yast::URL.HidePassword(url), url: url,
+          repo_alias: repo_alias, autorefresh: autorefresh, priority: priority)
       end
 
       # returns user repositories as it was previously specified

service/package/rubygem-agama-yast.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Tue Feb 24 16:59:38 UTC 2026 - Ladislav Slezák <lslezak@suse.com>
+
+- Do not log the URL password in the "inst.install_url" boot
+  parameter (bsc#1258701)
+
 -------------------------------------------------------------------
 Fri Nov  7 15:14:51 UTC 2025 - Ancor Gonzalez Sosa <ancor@suse.com>
 

service/test/agama/cmdline_args_test.rb

@@ -68,4 +68,18 @@
       expect { described_class.read_from(broken_config) }.to_not raise_error
     end
   end
+
+  describe "#to_s" do
+    it "hides the password in the install_url" do
+      args = described_class.new({ "install_url" => "https://u:secret_password@example.com" })
+      expect(args.to_s).to_not include("secret_password")
+    end
+  end
+
+  describe "#inspect" do
+    it "hides the password in the install_url" do
+      args = described_class.new({ "install_url" => "https://u:secret_password@example.com" })
+      expect(args.inspect).to_not include("secret_password")
+    end
+  end
 end