shared/redaction: mask_database_url() regex fails when password contains @ symbol — password leak #10582

New issue

Open

opened 2026-04-18 17:51:57 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-18 17:51:57 +00:00

Owner

Metadata

Commit Message: Fix mask_database_url() to handle passwords containing @ symbol

Branch: main

Background and Context

The mask_database_url() function in src/cleveragents/shared/redaction.py (lines 195-210) uses a regex pattern that assumes the password doesn't contain the @ symbol. This is a critical security vulnerability because:

The @ symbol is a valid character in URL-encoded passwords
When a database URL has a password containing @, the regex matches incorrectly
This causes the function to fail to properly mask the password, potentially leaking sensitive credentials in logs and error messages

Current Implementation Issue:
The regex pattern at line 203: r"(://[^:]+:)([^@]+)(@)" matches everything up to the first @ symbol, assuming that's the password/username separator. If the password itself contains @, the pattern will match only the portion before the first @ in the password, leaving the rest exposed.

Example of the vulnerability:

url = "postgresql://user:pass@word@localhost:5432/mydb"
# Current behavior: postgresql://user:***@word@localhost:5432/mydb
# Expected behavior: postgresql://user:***@localhost:5432/mydb
# The password "pass@word" is not fully masked — "word" is exposed!

Expected Behavior

The mask_database_url() function should:

Properly identify and mask the entire password, regardless of whether it contains @ symbols
Preserve the URL structure (scheme, username, hostname, port, database)
Return a safely redacted URL suitable for logging and error messages
Handle edge cases: missing password, missing username, special characters in password

Acceptance Criteria

Passwords containing @ symbols are fully masked
URL structure is preserved (scheme, host, port, database path)
No password characters leak into the output
Function handles edge cases: no password, no username, special characters
All existing tests continue to pass
New unit tests cover passwords with @ symbols
Code review approved
Merged to main branch

Subtasks

Replace regex-based approach with urllib.parse for robust URL parsing
Implement the fixed mask_database_url() function using proper URL parsing
Add unit tests for passwords containing @ symbol
Add unit tests for other special characters in passwords (%, &, #, etc.)
Add integration tests with real database URLs
Update docstring with examples of edge cases
Run full test suite to ensure no regressions
Code review and approval

Definition of Done

The issue is complete when:

✅ The mask_database_url() function uses urllib.parse instead of regex
✅ All unit tests pass, including new tests for @ in passwords
✅ Code coverage remains >= 97%
✅ The fix has been reviewed and approved
✅ Changes are merged to the main branch
✅ No password leakage occurs in any test case

Automated by CleverAgents Bot
Agent: new-issue-creator

## Metadata **Commit Message:** Fix mask_database_url() to handle passwords containing @ symbol **Branch:** main --- ## Background and Context The `mask_database_url()` function in `src/cleveragents/shared/redaction.py` (lines 195-210) uses a regex pattern that assumes the password doesn't contain the @ symbol. This is a critical security vulnerability because: 1. The @ symbol is a valid character in URL-encoded passwords 2. When a database URL has a password containing @, the regex matches incorrectly 3. This causes the function to fail to properly mask the password, potentially leaking sensitive credentials in logs and error messages **Current Implementation Issue:** The regex pattern at line 203: `r"(://[^:]+:)([^@]+)(@)"` matches everything up to the **first** @ symbol, assuming that's the password/username separator. If the password itself contains @, the pattern will match only the portion before the first @ in the password, leaving the rest exposed. **Example of the vulnerability:** ```python url = "postgresql://user:pass@word@localhost:5432/mydb" # Current behavior: postgresql://user:***@word@localhost:5432/mydb # Expected behavior: postgresql://user:***@localhost:5432/mydb # The password "pass@word" is not fully masked — "word" is exposed! ``` --- ## Expected Behavior The `mask_database_url()` function should: 1. Properly identify and mask the entire password, regardless of whether it contains @ symbols 2. Preserve the URL structure (scheme, username, hostname, port, database) 3. Return a safely redacted URL suitable for logging and error messages 4. Handle edge cases: missing password, missing username, special characters in password --- ## Acceptance Criteria - [ ] Passwords containing @ symbols are fully masked - [ ] URL structure is preserved (scheme, host, port, database path) - [ ] No password characters leak into the output - [ ] Function handles edge cases: no password, no username, special characters - [ ] All existing tests continue to pass - [ ] New unit tests cover passwords with @ symbols - [ ] Code review approved - [ ] Merged to main branch --- ## Subtasks - [ ] Replace regex-based approach with `urllib.parse` for robust URL parsing - [ ] Implement the fixed `mask_database_url()` function using proper URL parsing - [ ] Add unit tests for passwords containing @ symbol - [ ] Add unit tests for other special characters in passwords (%, &, #, etc.) - [ ] Add integration tests with real database URLs - [ ] Update docstring with examples of edge cases - [ ] Run full test suite to ensure no regressions - [ ] Code review and approval --- ## Definition of Done The issue is complete when: 1. ✅ The `mask_database_url()` function uses `urllib.parse` instead of regex 2. ✅ All unit tests pass, including new tests for @ in passwords 3. ✅ Code coverage remains >= 97% 4. ✅ The fix has been reviewed and approved 5. ✅ Changes are merged to the main branch 6. ✅ No password leakage occurs in any test case --- **Automated by CleverAgents Bot** Agent: new-issue-creator

HAL9000 added the

labels

2026-04-18 17:54:55 +00:00