From 4537814dcae92722a0013e793cae058820f056e4 Mon Sep 17 00:00:00 2001 From: Zanie Blue Date: Fri, 28 Aug 2026 17:08:15 -0500 Subject: [PATCH] Redact Azure shared access signatures in URLs --- crates/uv-redacted/src/lib.rs | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/crates/uv-redacted/src/lib.rs b/crates/uv-redacted/src/lib.rs index 5864bae9007..5eaca0efc2b 100644 --- a/crates/uv-redacted/src/lib.rs +++ b/crates/uv-redacted/src/lib.rs @@ -8,6 +8,7 @@ use thiserror::Error; use url::Url; const SENSITIVE_QUERY_PARAMETERS: &[&str] = &[ + "sig", "X-Amz-Credential", "X-Amz-Security-Token", "X-Amz-Signature", @@ -545,6 +546,27 @@ mod tests { ); } + #[test] + fn redact_azure_shared_access_signature() -> Result<(), DisplaySafeUrlError> { + let url = DisplaySafeUrl::parse( + "https://example.blob.core.windows.net/dist.whl?sv=2026-01-01&sig=signature&sp=r", + )?; + assert_eq!( + url.to_string(), + "https://example.blob.core.windows.net/dist.whl?sv=2026-01-01&sig=****&sp=r" + ); + assert_eq!( + url.redact_in(&format!("failed to fetch '{}'", url.as_str())), + "failed to fetch 'https://example.blob.core.windows.net/dist.whl?sv=2026-01-01&sig=****&sp=r'" + ); + // Formatting must not alter the signature used in actual requests. + assert_eq!( + url.as_str(), + "https://example.blob.core.windows.net/dist.whl?sv=2026-01-01&sig=signature&sp=r" + ); + Ok(()) + } + #[test] fn redact_aws_presigned_query_values_case_insensitive() { let log_safe_url = DisplaySafeUrl::parse(