lib,test: redact proxy credentials in tunnel errors

mcollina · aduh95 · commit 9b6af26132f6 · 2026-06-17T19:52:19.000+02:00
Refs: https://hackerone.com/reports/3720313 Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs-private/node-private#867 Backport-PR-URL: nodejs-private/node-private#894 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> CVE-ID: CVE-2026-48615
diff --git a/lib/internal/http.js b/lib/internal/http.js
@@ -98,7 +98,7 @@ function ipToInt(ip) {
 /**
  * Represents the proxy configuration for an agent. The built-in http and https agent
  * implementation have one of this when they are configured to use a proxy.
- * @property {string} href - Full URL of the proxy server.
+ * @property {string} href - Proxy server URL with credentials redacted.
  * @property {string} host - Full host including port, e.g. 'localhost:8080'.
  * @property {string} hostname - Hostname without brackets for IPv6 addresses.
  * @property {number} port - Port number of the proxy server.
@@ -109,13 +109,27 @@ function ipToInt(ip) {
  */
 class ProxyConfig {
   constructor(proxyUrl, keepAlive, noProxyList) {
-    const { host, hostname, port, protocol, username, password } = new URL(proxyUrl);
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(proxyUrl);
+    } catch {
+      throw new ERR_PROXY_INVALID_CONFIG(`Invalid proxy URL: ${proxyUrl}`);
+    }
+    const { host, hostname, port, protocol, username, password } = parsedUrl;
     this.href = proxyUrl; // Full URL of the proxy server.
     this.host = host; // Full host including port, e.g. 'localhost:8080'.
     this.hostname = hostname.replace(/^\[|\]$/g, ''); // Trim off the brackets from IPv6 addresses.
     this.port = port ? NumberParseInt(port, 10) : (protocol === 'https:' ? 443 : 80);
     this.protocol = protocol; // Protocol of the proxy server, e.g. 'http:' or 'https:'.
 
+    if (username || password) {
+      parsedUrl.username = '';
+      parsedUrl.password = '';
+      this.href = parsedUrl.href;
+    } else {
+      this.href = proxyUrl;
+    }
+
     if (username || password) {
       // If username or password is provided, prepare the proxy-authorization header.
       const auth = `${decodeURIComponent(username)}:${decodeURIComponent(password)}`;
diff --git a/test/client-proxy/test-https-proxy-request-auth-failure.mjs b/test/client-proxy/test-https-proxy-request-auth-failure.mjs
@@ -53,6 +53,9 @@ const { code, signal, stderr } = await runProxiedRequest({
 // The proxy client should get an error from proxy authentication failure.
 // Since the process exits cleanly but with an error, check for any error output
 assert.match(stderr, /407 Proxy Authentication Required/);
+assert.match(stderr, /via http:\/\/localhost:\d+\/?/);
+assert.doesNotMatch(stderr, /baduser/);
+assert.doesNotMatch(stderr, /badpass/);
 assert.strictEqual(code, 0);
 assert.strictEqual(signal, null);
 
