fix(util/host-rules): sanitise TLS credential fields in hostRules (#45119)

* chore(util): note that `httpsCertificate` and `httpsCertificateAuthority` aren't secret

Although we're currently treating them as such, they're not technically
unsafe to appear in the logs, as a Certificate (and the authority) are
public.

* fix(util/host-rules): sanitise TLS credential fields in hostRules

We previously noted that the `httpsPrivateKey`, `httpsCertificate`, and
`httpsCertificateAuthority` fields would be marked as confidential, but
we weren't correctly sanitising them.

We can make sure that these fields are correctly flagged as secret
("confidential") and that they need to be sanitised when referenced.

Although the `httpsCertificate` and `httpsCertificateAuthority` aren't
secret, we can keep them sanitised for consistency with how we've
currently documented them as being sanitised.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* test(util/host-rules): ensure that all secret fields are marked as secret

As a way to make sure that new fields being added `HostRule`s are
considered as to whether the field should be marked as secret
("confidential") or not, we can add a test (and a compile-time
exhaustive check) to validate that `redactedFields` and
`confidentialFields` are kept in sync.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

Author: jamietanna

lib/util/host-rules.spec.ts

@@ -1,19 +1,60 @@
 import { NugetDatasource } from '../modules/datasource/nuget/index.ts';
+import type { HostRule } from '../types/index.ts';
 import {
   add,
   clear,
+  confidentialFields,
   find,
   findAll,
   getAll,
   hostType,
   hosts,
 } from './host-rules.ts';
+import { redactedFields, sanitize } from './sanitize.ts';
 
 describe('util/host-rules', () => {
   beforeEach(() => {
     clear();
   });
 
+  it('registers every redactedFields entry that is a HostRule field for value-level sanitizing', () => {
+    // exhaustive check for fields of `HostRule`, to introduce a compile-time error when adding a new field to `HostRule`
+    const allHostRuleFields: Record<keyof HostRule, true> = {
+      authType: true,
+      token: true,
+      username: true,
+      password: true,
+      insecureRegistry: true,
+      timeout: true,
+      abortOnError: true,
+      abortIgnoreStatusCodes: true,
+      enabled: true,
+      enableHttp2: true,
+      concurrentRequestLimit: true,
+      maxRequestsPerSecond: true,
+      headers: true,
+      maxRetryAfter: true,
+      keepAlive: true,
+      artifactAuth: true,
+      httpsCertificateAuthority: true,
+      httpsPrivateKey: true,
+      httpsCertificate: true,
+      encrypted: true,
+      hostType: true,
+      matchHost: true,
+      resolvedHost: true,
+      readOnly: true,
+    };
+
+    const expectedConfidentialFields = redactedFields.filter(
+      (field) => field in allHostRuleFields,
+    );
+
+    expect([...confidentialFields].sort()).toEqual(
+      expectedConfidentialFields.sort(),
+    );
+  });
+
   describe('add()', () => {
     it('throws if both domainName and hostName', () => {
       expect(() =>
@@ -107,6 +148,20 @@ describe('util/host-rules', () => {
         username: 'user2',
       });
     });
+
+    it('sanitizes TLS credential values', () => {
+      add({
+        matchHost: 'https://some.endpoint',
+        httpsPrivateKey: 'private-key-value',
+        httpsCertificate: 'certificate-value',
+        httpsCertificateAuthority: 'certificate-authority-value',
+      });
+      expect(
+        sanitize(
+          'key=private-key-value cert=certificate-value ca=certificate-authority-value',
+        ),
+      ).toBe('key=**redacted** cert=**redacted** ca=**redacted**');
+    });
   });
 
   describe('find()', () => {

lib/util/host-rules.ts

@@ -8,6 +8,21 @@ import { isHttpUrl, massageHostUrl, parseUrl } from './url.ts';
 
 let hostRules: HostRule[] = [];
 
+/**
+ * Fields within `HostRule`s that must have their value registered for sanitising through `sanitize.addSecretForSanitizing()`.
+ *
+ * Kept in sync with `redactedFields` through tests.
+ */
+export const confidentialFields: (keyof HostRule)[] = [
+  'password',
+  'token',
+  'httpsPrivateKey',
+  /* not actually sensitive, but redacted nonetheless */
+  'httpsCertificate',
+  /* not actually sensitive, but redacted nonetheless */
+  'httpsCertificateAuthority',
+];
+
 export interface LegacyHostRule {
   hostName?: string;
   domainName?: string;
@@ -41,7 +56,6 @@ export function migrateRule(rule: LegacyHostRule & HostRule): HostRule {
 export function add(params: HostRule): void {
   const rule = migrateRule(params);
 
-  const confidentialFields: (keyof HostRule)[] = ['password', 'token'];
   if (rule.matchHost) {
     rule.matchHost = massageHostUrl(rule.matchHost);
     const parsedUrl = parseUrl(rule.matchHost);

lib/util/sanitize.ts

@@ -15,8 +15,10 @@ export const redactedFields = [
   'gitPrivateKey',
   'forkToken',
   'password',
+  /* not actually sensitive, but redacted nonetheless */
   'httpsCertificate',
   'httpsPrivateKey',
+  /* not actually sensitive, but redacted nonetheless */
   'httpsCertificateAuthority',
 ];