C#: Sanitize feed information before putting it in the log.

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

@@ -535,6 +535,21 @@ private void TryChangeProjectFile(DirectoryInfo projectDir, Regex pattern, strin
             }
         }
 
+        private string SanitizeFeedForLogging(string feed)
+        {
+
+            try
+            {
+                // If the feed is a URL, we only log the scheme, host, and absolute path to avoid logging sensitive information such as credentials or tokens.
+                var uri = new Uri(feed);
+                return $"{uri.Scheme}://{uri.Host}{uri.AbsolutePath}";
+            }
+            catch
+            {
+                return feed;
+            }
+        }
+
         /// <summary>
         /// If <paramref name="unreachableFeeds"/> is not empty, logs this and emits a diagnostic.
         /// Adds a `CompilationInfos` entry either way.
@@ -544,7 +559,10 @@ private void EmitFeedReachabilityDiagnostics(ImmutableHashSet<string> unreachabl
         {
             if (unreachableFeeds.Count > 0)
             {
-                var orderedUnreachableFeeds = unreachableFeeds.OrderBy(feed => feed).ToList();
+                var orderedUnreachableFeeds = unreachableFeeds
+                    .Select(SanitizeFeedForLogging)
+                    .OrderBy(feed => feed)
+                    .ToList();
                 var unreachableFeedList = string.Join(", ", orderedUnreachableFeeds);
                 logger.LogWarning($"Found unreachable NuGet feeds in C# analysis with build-mode 'none': {unreachableFeedList}. This may cause missing dependencies in the analysis.");
                 compilationInfoContainer.CompilationInfos.Add(("Unreachable NuGet feeds", unreachableFeedList));