fix(cli): Remove credentials from environment variables

Do not expose any credentials, e.g. when included in proxy URLs. Fixes #9294. Signed-off-by: Sebastian Schuberth <[email protected]>
oss-review-toolkit · Oct 17, 2024 · 03b4ed9 · 03b4ed9
1 parent 64dc2c1
commit 03b4ed9
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/cli/src/main/kotlin/OrtMain.kt b/cli/src/main/kotlin/OrtMain.kt
@@ -50,9 +50,11 @@ import org.ossreviewtoolkit.model.config.LicenseFilePatterns
 import org.ossreviewtoolkit.model.config.OrtConfiguration
 import org.ossreviewtoolkit.plugins.commands.api.OrtCommand
 import org.ossreviewtoolkit.utils.common.EnvironmentVariableFilter
+import org.ossreviewtoolkit.utils.common.MaskedString
 import org.ossreviewtoolkit.utils.common.Os
 import org.ossreviewtoolkit.utils.common.expandTilde
 import org.ossreviewtoolkit.utils.common.mebibytes
+import org.ossreviewtoolkit.utils.common.replaceCredentialsInUri
 import org.ossreviewtoolkit.utils.ort.Environment
 import org.ossreviewtoolkit.utils.ort.ORT_CONFIG_DIR_ENV_NAME
 import org.ossreviewtoolkit.utils.ort.ORT_CONFIG_FILENAME
@@ -208,7 +210,8 @@ class OrtMain : CliktCommand(ORT_NAME) {
                     ORT_DATA_DIR_ENV_NAME to ortDataDirectory.path,
                     *env.variables.toList().toTypedArray()
                 ).mapTo(content) { (key, value) ->
-                    "${Theme.Default.info(key)} = ${Theme.Default.warning(value)}"
+                    val safeValue = value.replaceCredentialsInUri(MaskedString.DEFAULT_MASK)
+                    "${Theme.Default.info(key)} = ${Theme.Default.warning(safeValue)}"
                 }
 
                 cell(content.joinToString("\n")) { columnSpan = 2 }