Fringg
3bf31055e7
- Apply sanitize_proxy_error() to all 8 error handlers in nalogo_service - Remove exc_info=True from error paths that could expose proxy creds - Fix regex backreference to preserve original SOCKS scheme - Consolidate proxy utility imports to module level - Add source indicator (NALOGO_PROXY_URL vs fallback) to startup log
36 lines
1.1 KiB
Python
36 lines
1.1 KiB
Python
"""Proxy URL utilities for safe logging and error handling."""
|
|
|
|
import re
|
|
from urllib.parse import urlparse
|
|
|
|
|
|
def mask_proxy_url(proxy_url: str) -> str:
|
|
"""Mask credentials in a proxy URL for safe logging.
|
|
|
|
Handles edge cases:
|
|
- No credentials: returns URL as-is
|
|
- Username + password: masks both with ***
|
|
- Password-only: masks as well
|
|
- No explicit port: omits :port part
|
|
"""
|
|
parsed = urlparse(proxy_url)
|
|
if not parsed.username and not parsed.password:
|
|
return proxy_url
|
|
host = parsed.hostname or 'unknown'
|
|
port_part = f':{parsed.port}' if parsed.port else ''
|
|
return f'{parsed.scheme}://***@{host}{port_part}'
|
|
|
|
|
|
_PROXY_CRED_RE = re.compile(r'(socks[45h]*://)([^@\s]+@)', re.IGNORECASE)
|
|
|
|
|
|
def sanitize_proxy_error(error: Exception) -> str:
|
|
"""Strip proxy credentials from exception messages.
|
|
|
|
httpx/socksio may include the full proxy URL (with credentials)
|
|
in connection error messages and tracebacks. This function removes
|
|
credentials from the error string while preserving the original scheme.
|
|
"""
|
|
msg = str(error)
|
|
return _PROXY_CRED_RE.sub(r'\1***@', msg)
|