Redact credentials from logged URLs, VEX product ids and hosted Composer locks

[Mikola Lysenko (mikolalysenko)]

Problem

Architecture audit, credential leaks:

• B02 / Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399: the hosted Composer rewrite pointed dist.url at the patch host but kept the entry's transport-options. Composer copies a repository's options (http.header auth tokens, ssl client certificates, http.proxy) into each lock entry and applies them to that entry's dist download, so every composer install sent the private registry's credentials to the hosted patch server. The vendored backend already dropped the key, but with its own hand-written list.

• B26: grant tokens and URL userinfo reached --json events, CI logs, debug output and telemetry:

  • 8 hand-written vendor_prebuilt_downloaded advisories quoted the grant URL;
  • registry_fetch::download and the Maven fetch errors quoted GOPROXY, .npmrc and mirror URLs, reqwest's error text included;
  • client.rs debug lines and artifact errors quoted grant URLs;
  • telemetry::sanitize_error_message only replaced $HOME, and patch_fetch_failed.uuid carried whatever identifier the user passed (CVE, purl, private package name).

  redirect::redact_grant_token had a single caller.

• B21: the VEX product @id fell back to the raw git origin URL for unknown hosts and GitLab subgroups, so https://gitlab-ci-token:<token>@… and https://<PAT>@… were published in the OpenVEX document.

Change

• New utils::redact is the one redactor. redact_url / redact_urls_in replace userinfo, the Socket grant-token level (the path level before the patch uuid under /patch/ or /patch-registry/) and secret query values with <redacted>. strip_url_credentials is the identifier form, and url_host is the userinfo-safe host.

• Each emission point now goes through it:

  • VendorWarning::new (every vendor advisory);
  • registry_fetch::download and maven_repo::fetch_registry_bytes;
  • api::client's debug_log, network_error_detail and artifact errors;
  • telemetry::sanitize_error_message.

  patch_fetch_failed now sends uuid only when the identifier is a uuid.

• VEX: a remote that falls back to the URL is stripped of credentials first. An ssh login name (ssh://git@host/…) and scp-like remotes are kept, so existing product ids don't change.

• Composer: formats::composer::ORIGIN_BOUND_ENTRY_KEYS (source, transport-options) is shared by the vendored rewrite_lock_entry and the hosted apply_dist_edit.

  • The hosted splice drops every listed member, rescanning between removals so adjacent members never leave a dangling comma.
  • It widens the recorded edit to cover every changed byte, so the ledger's fragment revert restores them.
  • It warns with the new code redirect_composer_transport_options_removed, documented in docs/testing/composer-compatibility.md.

Duplicate copies deleted

What	Before	After
vendor_prebuilt_downloaded advisory builders	8	1 (VerifiedArchive::downloaded_warning, pinned by a ratchet test)
URL redactors	2 (redirect::redact_grant_token with 1 caller; hosted::guidance::url_host's userinfo strip)	1 (utils::redact)
Userinfo-stripping host extractors	2 (hosted::guidance::url_host, patch/redirect/upstream/uv.rs)	1
Composer origin-bound key lists	2 (vendored match arms; hosted source-only plan)	1

Testing

Run on macOS:

• cargo test -p socket-patch-core --lib: 5585 passed, 2 failed. After regenerating the vex-discover golden for the new fixture, vex::discover::testing::golden passes. The other failure, utils::digest::tests::production_digests_go_through_the_helpers, fails on main too: it names crawlers/gradle_cache.rs, patch/jvm_jar.rs and patch/sidecars/maven.rs, none of which this PR touches.
• cargo test -p socket-patch-core --test redirect_golden --test upstream_restore_golden passed, including the new composer-lock/transport-options case and its round-trip restore.
• cargo test -p socket-patch-cli passed for in_process_redirect, hosted_memory_engine, hosted_memory_parity, e2e_vex, covgap_commands_vex, in_process_vendor, scan_vendor_e2e, e2e_vendored_production, e2e_hosted_production and e2e_embedded_vex.
• cargo clippy -p socket-patch-core --all-targets -- -D warnings reports only lints that already fail on main under the local toolchain: maven_repo.rs:2514 and nuget_feed.rs:2005 (empty line after doc comment) and python_crawler.rs:2734 (unused unix_default). There are no lints in changed code. The same python_crawler lint stops the CLI clippy build.
• New tests:
  • utils::redact unit tests and the ratchet;
  • telemetry URL redaction and uuid-only field;
  • vex::product::remote_url_credentials_never_reach_the_product_id;
  • formats::composer::source::transport_options_are_dropped_with_source_in_any_layout;
  • golden composer-lock/transport-options.

Deferred

• depscan's TS twin (composer-lock-members.ts) has to port the transport-options drop to stay byte-identical. The shared golden composer-lock/transport-options will fail there until it does.
• Not every hosted RewriteWarning goes through the redactor: they are built as struct literals at about 180 sites. Most already quote only url_host. The Gradle/sbt guidance snippets embed the repository URL on purpose, because the user is meant to paste it. A CLI-envelope-level choke point needs a decision about those snippets.
• update/release.rs keeps its own reqwest-based url_host, which normalizes ports differently.
• GitLab subgroup purls (pkg:gitlab with a namespace) are not done. The fallback is now credential-free.
• No maintainer decisions are touched (Decide: one shape for the --json top-level error (scan and get emit both a string and a {code, message} object) #704, Decide: warn on and then remove scan --apply/--vendor, and whether --vex stays embedded #966, Decide: give SOCKET_FORCE per-command names so forcing a self-update doesn't also force apply and vendor #615, Decide: where patch API calls go when a token is set but the org slug can't be resolved #648).

🤖 Generated with Claude Code