Redact pre-signed upload URLs

Author: zsol

crates/uv-redacted/src/lib.rs

@@ -7,6 +7,12 @@ use std::str::FromStr;
 use thiserror::Error;
 use url::Url;
 
+const SENSITIVE_QUERY_PARAMETERS: &[&str] = &[
+    "X-Amz-Credential",
+    "X-Amz-Security-Token",
+    "X-Amz-Signature",
+];
+
 #[derive(Error, Debug, Clone, PartialEq, Eq)]
 pub enum DisplaySafeUrlError {
     /// Failed to parse a URL.
@@ -19,7 +25,7 @@ pub enum DisplaySafeUrlError {
     AmbiguousAuthority(String),
 }
 
-/// A [`Url`] wrapper that redacts credentials when displaying the URL.
+/// A [`Url`] wrapper that redacts credentials and sensitive query parameters when displaying the URL.
 ///
 /// `DisplaySafeUrl` wraps the standard [`url::Url`] type, providing functionality to mask
 /// secrets by default when the URL is displayed or logged. This helps prevent accidental
@@ -260,6 +266,8 @@ impl Debug for DisplaySafeUrl {
         } else {
             ("", None)
         };
+        let query = url.query().map(redact_sensitive_query_values);
+        let query = query.as_ref().map(std::convert::AsRef::as_ref);
 
         f.debug_struct("DisplaySafeUrl")
             .field("scheme", &url.scheme())
@@ -269,7 +277,7 @@ impl Debug for DisplaySafeUrl {
             .field("host", &url.host())
             .field("port", &url.port())
             .field("path", &url.path())
-            .field("query", &url.query())
+            .field("query", &query)
             .field("fragment", &url.fragment())
             .finish()
     }
@@ -301,17 +309,64 @@ fn is_ssh_git_username(url: &Url) -> bool {
         && url.password().is_none()
 }
 
-fn display_with_redacted_credentials(
+fn is_sensitive_query_parameter(key: &str) -> bool {
+    SENSITIVE_QUERY_PARAMETERS
+        .iter()
+        .any(|sensitive| key.eq_ignore_ascii_case(sensitive))
+}
+
+fn redact_sensitive_query_values(query: &str) -> Cow<'_, str> {
+    let mut redacted = String::with_capacity(query.len());
+    let mut changed = false;
+
+    for (index, pair) in query.split('&').enumerate() {
+        if index > 0 {
+            redacted.push('&');
+        }
+
+        let Some((key, value)) = pair.split_once('=') else {
+            redacted.push_str(pair);
+            continue;
+        };
+
+        redacted.push_str(key);
+        redacted.push('=');
+        if is_sensitive_query_parameter(key) {
+            redacted.push_str("****");
+            changed = true;
+        } else {
+            redacted.push_str(value);
+        }
+    }
+
+    if changed {
+        Cow::Owned(redacted)
+    } else {
+        Cow::Borrowed(query)
+    }
+}
+
+fn display_with_query(
     url: &Url,
+    query: Option<&str>,
     f: &mut std::fmt::Formatter<'_>,
 ) -> std::fmt::Result {
-    if url.password().is_none() && url.username() == "" {
-        return write!(f, "{url}");
-    }
+    let mut url = url.clone();
+    url.set_query(query);
+    write!(f, "{url}")
+}
 
+fn display_with_redacted_credentials(
+    url: &Url,
+    f: &mut std::fmt::Formatter<'_>,
+) -> std::fmt::Result {
+    let query = url.query().map(redact_sensitive_query_values);
     // For URLs that use the `git` convention (i.e., `ssh://git@github.com/...`), avoid dropping the
     // username.
-    if is_ssh_git_username(url) {
+    if is_ssh_git_username(url) || (url.username().is_empty() && url.password().is_none()) {
+        if let Some(Cow::Owned(query)) = query {
+            return display_with_query(url, Some(&query), f);
+        }
         return write!(f, "{url}");
     }
 
@@ -333,7 +388,7 @@ fn display_with_redacted_credentials(
     }
 
     write!(f, "{}", url.path())?;
-    if let Some(query) = url.query() {
+    if let Some(query) = query {
         write!(f, "?{query}")?;
     }
     if let Some(fragment) = url.fragment() {
@@ -461,6 +516,56 @@ mod tests {
         );
     }
 
+    #[test]
+    fn redact_aws_presigned_query_values() {
+        let log_safe_url = DisplaySafeUrl::parse(
+            "https://bucket.s3.amazonaws.com/dist.whl?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=credential&X-Amz-Date=20260424T120000Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=signature&X-Amz-Security-Token=token",
+        )
+        .unwrap();
+
+        assert_eq!(
+            log_safe_url.to_string(),
+            "https://bucket.s3.amazonaws.com/dist.whl?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=****&X-Amz-Date=20260424T120000Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=****&X-Amz-Security-Token=****"
+        );
+    }
+
+    #[test]
+    fn redact_aws_presigned_query_values_case_insensitive() {
+        let log_safe_url = DisplaySafeUrl::parse(
+            "https://bucket.s3.amazonaws.com/dist.whl?x-amz-credential=credential&x-amz-signature=signature&x-amz-security-token=token",
+        )
+        .unwrap();
+
+        assert_eq!(
+            log_safe_url.to_string(),
+            "https://bucket.s3.amazonaws.com/dist.whl?x-amz-credential=****&x-amz-signature=****&x-amz-security-token=****"
+        );
+    }
+
+    #[test]
+    fn redact_aws_presigned_query_values_in_debug() {
+        let log_safe_url = DisplaySafeUrl::parse(
+            "https://bucket.s3.amazonaws.com/dist.whl?X-Amz-Credential=credential&X-Amz-Signature=signature",
+        )
+        .unwrap();
+
+        let debug = format!("{log_safe_url:?}");
+        assert!(debug.contains(r#"query: Some("X-Amz-Credential=****&X-Amz-Signature=****")"#));
+        assert!(!debug.contains("credential"));
+        assert!(!debug.contains("signature"));
+    }
+
+    #[test]
+    fn does_not_redact_unknown_query_values() {
+        let log_safe_url =
+            DisplaySafeUrl::parse("https://bucket.s3.amazonaws.com/dist.whl?token=secret").unwrap();
+
+        assert_eq!(
+            log_safe_url.to_string(),
+            "https://bucket.s3.amazonaws.com/dist.whl?token=secret"
+        );
+    }
+
     #[test]
     fn url_join() {
         let url_str = "https://token@example.com/abc/";

crates/uv/tests/it/publish.rs

@@ -623,6 +623,67 @@ async fn gitlab_trusted_publishing_testpypi_id_token() {
     );
 }
 
+#[tokio::test]
+async fn direct_publish_redacts_presigned_upload_url() {
+    let context = uv_test::test_context!("3.12");
+    let server = MockServer::start().await;
+
+    let upload_url = format!(
+        "{}/s3/ok-1.0.0-py3-none-any.whl?X-Amz-Credential=credential&X-Amz-Signature=signature&X-Amz-Security-Token=token",
+        server.uri()
+    );
+
+    Mock::given(method("POST"))
+        .and(path("/upload/reserve"))
+        .respond_with(ResponseTemplate::new(201).set_body_json(json!({
+            "upload_url": upload_url,
+        })))
+        .mount(&server)
+        .await;
+    Mock::given(method("PUT"))
+        .and(path("/s3/ok-1.0.0-py3-none-any.whl"))
+        .respond_with(ResponseTemplate::new(200))
+        .mount(&server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/upload/finalize"))
+        .respond_with(ResponseTemplate::new(200))
+        .mount(&server)
+        .await;
+
+    uv_snapshot!(context.filters(), context.publish()
+        .arg("--preview-features")
+        .arg("direct-publish")
+        .arg("--direct")
+        .arg("-u")
+        .arg("dummy")
+        .arg("-p")
+        .arg("dummy")
+        .arg("--publish-url")
+        .arg(format!("{}/upload", server.uri()))
+        .arg(dummy_wheel())
+        .env(EnvVars::RUST_LOG, "uv_publish=debug"), @"
+    success: true
+    exit_code: 0
+    ----- stdout -----
+
+    ----- stderr -----
+    Publishing 1 file to http://[LOCALHOST]/upload
+    Hashing ok-1.0.0-py3-none-any.whl ([SIZE])
+    DEBUG Hashing [WORKSPACE]/test/links/ok-1.0.0-py3-none-any.whl
+    Uploading ok-1.0.0-py3-none-any.whl ([SIZE])
+    DEBUG Reserving upload slot at http://[LOCALHOST]/upload/reserve
+    DEBUG Using HTTP Basic authentication
+    DEBUG Got pre-signed URL for upload: http://[LOCALHOST]/s3/ok-1.0.0-py3-none-any.whl?X-Amz-Credential=****&X-Amz-Signature=****&X-Amz-Security-Token=****
+    DEBUG S3 upload complete for ok-1.0.0-py3-none-any.whl
+    DEBUG Finalizing upload at http://[LOCALHOST]/upload/finalize
+    DEBUG Using HTTP Basic authentication
+    DEBUG Response code for http://[LOCALHOST]/upload/finalize: 200 OK
+    DEBUG Upload finalized for ok-1.0.0-py3-none-any.whl
+    "
+    );
+}
+
 /// PyPI returns `application/json` errors with a `code` field.
 #[tokio::test]
 async fn upload_error_pypi_json() {