rethink-public/commons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: mask_url re-encodes non-sensitive query values on rebuild (v0.3.4)

Browse Source 
the identity quote_via lambda disabled percent-encoding on re-emit, so a
non-sensitive value with a reserved character (e.g. x=%26%3D) came out
structurally corrupted (x=&=). re-encode with quote_plus (safe="*" so the
masked "***" stays literal) instead of the identity function - display
fidelity only, the secret is still always masked to "***" first.

Signed-off-by: disqualifier <dev@disqualifier.me>
This commit is contained in:
dsql
2026-07-03 16:20:50 -04:00
parent 18646f313c
commit e86184986f
4 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -5
View File
@@ -12,15 +12,15 @@ Small sync helpers shared across projects. Base is stdlib only — **no dependen
## Install
```
commons @ git+ssh://git@git.rethinkstudios.io/rethink-public/commons.git@v0.3.3
commons @ git+ssh://git@git.rethinkstudios.io/rethink-public/commons.git@v0.3.4
# async address/geo lookups (fetch_ip / ip_location / fetch_location) need the extra:
commons[addr] @ git+ssh://git@git.rethinkstudios.io/rethink-public/commons.git@v0.3.3
commons[addr] @ git+ssh://git@git.rethinkstudios.io/rethink-public/commons.git@v0.3.4
```
The base install pulls **nothing** (stdlib). Only `commons[addr]` adds `aiohttp`, and
only for the geo lookups — the pure `commons.addr.ip` utilities ship in base.
Drop the `@v0.3.3` suffix from the line above to install the latest unpinned.
Drop the `@v0.3.4` suffix from the line above to install the latest unpinned.
## timing
@@ -135,8 +135,10 @@ mask_proxy("1.2.3.4:8080") # -> "1.2.3.4:8080" (no auth, unt
`mask_url` strips `user:pass@` userinfo and replaces the values of sensitive query
params (`apiKey`, `token`, `password`, `secret`, …; override via `keys=`) with `***`.
`mask_proxy` bullets the password of a `host:port:user:password` spec. Non-URL /
non-conforming input is returned unchanged.
Non-sensitive query values are re-percent-encoded on the way out, so a value with a
reserved character (`&`, `=`, a space, …) round-trips correctly instead of corrupting
the rebuilt URL. `mask_proxy` bullets the password of a `host:port:user:password`
spec. Non-URL / non-conforming input is returned unchanged.
## retry