Redact URLs when recording target metadata (#47)

* Redact URLs when recording target metadata

* Make the linter happy

Author: Douglas Camata

internal/integration/rules_test.go

@@ -5,6 +5,7 @@ package integration
 
 import (
 	"fmt"
+	"net/url"
 	"strings"
 	"testing"
 
@@ -360,9 +361,11 @@ some_undecorated_stuff{addr="ohai-playground-redis-slave:6379",alias="ohai-playg
 }
 
 func TestDecorate(t *testing.T) {
+	targetURL, _ := url.Parse("https://user:[email protected]")
 	se := []TargetMetrics{{
 		Target: endpoints.Target{
 			Name: "a_simple_target",
+			URL:  *targetURL,
 			Object: endpoints.Object{
 				Labels: labels.Set{
 					"hello": "friend",
@@ -378,8 +381,8 @@ func TestDecorate(t *testing.T) {
 
 	Decorate(&se[0], []DecorateRule{})
 
-	assert.Equal(t, se[0].Metrics[0].attributes, labels.Set{"hello": "friend", "bye": "boy", "md1": "v1", "md2": "v2", "attr1": "val1"})
-	assert.Equal(t, se[0].Metrics[1].attributes, labels.Set{"hello": "friend", "bye": "boy", "md3": "v3", "md4": "v4", "attr2": "val2"})
+	assert.Equal(t, se[0].Metrics[0].attributes, labels.Set{"hello": "friend", "bye": "boy", "md1": "v1", "md2": "v2", "attr1": "val1", "scrapedTargetURL": "https://user:[email protected]"})
+	assert.Equal(t, se[0].Metrics[1].attributes, labels.Set{"hello": "friend", "bye": "boy", "md3": "v3", "md4": "v4", "attr2": "val2", "scrapedTargetURL": "https://user:[email protected]"})
 
 }
 

internal/pkg/endpoints/endpoints.go

@@ -40,8 +40,8 @@ type Target struct {
 func (t *Target) Metadata() labels.Set {
 	if t.metadata == nil {
 		metadata := labels.Set{}
-		if t.URL.String() != "" {
-			metadata["scrapedTargetURL"] = t.URL.String()
+		if targetURL := redactedURLString(&t.URL); targetURL != "" {
+			metadata["scrapedTargetURL"] = targetURL
 		}
 		if t.Object.Name != "" {
 			metadata["scrapedTargetName"] = t.Object.Name
@@ -54,6 +54,20 @@ func (t *Target) Metadata() labels.Set {
 	return t.metadata
 }
 
+// redactedURLString returns the string representation of the URL object while redacting the password that could be present.
+// This code is copied from this commit https://github.com/golang/go/commit/e3323f57df1f4a44093a2d25fee33513325cbb86.
+// The feature is supposed to be added to the net/url.URL type in Golang 1.15.
+func redactedURLString(u *url.URL) string {
+	if u == nil {
+		return ""
+	}
+	ru := *u
+	if _, has := ru.User.Password(); has {
+		ru.User = url.UserPassword(ru.User.Username(), "xxxxx")
+	}
+	return ru.String()
+}
+
 // New returns a Target from the discovered information
 func New(name string, addr url.URL, object Object) Target {
 	return Target{