fix(proxy): sanitise password components in HTTP_PROXY variable(s) in logs (#45117)

If a proxy URL appears to have a password component in it, we should
make sure that this is sanitised.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

Author: jamietanna

lib/proxy.spec.ts

@@ -1,4 +1,7 @@
 import { bootstrap, hasProxy } from './proxy.ts';
+import * as sanitize from './util/sanitize.ts';
+
+const addSecretForSanitizing = vi.spyOn(sanitize, 'addSecretForSanitizing');
 
 describe('proxy', () => {
   const httpProxy = 'http://example.org/http-proxy';
@@ -57,4 +60,34 @@ describe('proxy', () => {
     bootstrap();
     expect(hasProxy()).toBeFalse();
   });
+
+  it('sanitizes password from HTTP_PROXY credentials', () => {
+    process.env.HTTP_PROXY = 'http://user:s3cr3t@example.org';
+    bootstrap();
+    expect(addSecretForSanitizing).toHaveBeenCalledWith('s3cr3t', 'global');
+  });
+
+  it('sanitizes password from HTTPS_PROXY credentials', () => {
+    process.env.HTTPS_PROXY = 'http://user:s3cr3t@example.org';
+    bootstrap();
+    expect(addSecretForSanitizing).toHaveBeenCalledWith('s3cr3t', 'global');
+  });
+
+  it('does not sanitize username-only proxy credentials', () => {
+    process.env.HTTP_PROXY = 'http://user@example.org';
+    bootstrap();
+    expect(addSecretForSanitizing).not.toHaveBeenCalled();
+  });
+
+  it('sanitizes password-only proxy credentials', () => {
+    process.env.HTTP_PROXY = 'http://:s3cr3t@example.org';
+    bootstrap();
+    expect(addSecretForSanitizing).toHaveBeenCalledWith('s3cr3t', 'global');
+  });
+
+  it('does not sanitize when proxy has no credentials', () => {
+    process.env.HTTP_PROXY = httpProxy;
+    bootstrap();
+    expect(addSecretForSanitizing).not.toHaveBeenCalled();
+  });
 });

lib/proxy.ts

@@ -1,11 +1,21 @@
 import { isNonEmptyString } from '@sindresorhus/is';
 import { createGlobalProxyAgent } from 'global-agent';
 import { logger } from './logger/index.ts';
+import { addSecretForSanitizing } from './util/sanitize.ts';
+import { parseUrl } from './util/url.ts';
 
 const envVars = ['HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY'];
+const proxyEnvVarsWithCredentials = ['HTTP_PROXY', 'HTTPS_PROXY'];
 
 let agent = false;
 
+function sanitizeProxyCredentials(envVar: string): void {
+  const uri = parseUrl(process.env[envVar]);
+  if (uri?.password) {
+    addSecretForSanitizing(uri.password, 'global');
+  }
+}
+
 export function bootstrap(): void {
   envVars.forEach((envVar) => {
     /* v8 ignore next -- env is case-insensitive on windows */
@@ -22,6 +32,8 @@ export function bootstrap(): void {
     }
   });
 
+  proxyEnvVarsWithCredentials.forEach(sanitizeProxyCredentials);
+
   if (
     isNonEmptyString(process.env.HTTP_PROXY) ||
     isNonEmptyString(process.env.HTTPS_PROXY)