From b067e9602126480e7a18dc5b2a8314dedf26cd5d Mon Sep 17 00:00:00 2001 From: Ayesh Karunaratne Date: Thu, 20 Oct 2022 16:28:51 +0530 Subject: [PATCH] Update URL masking patterns for new GitHub fine-grained PATs Updates GitHub Personal Access Token regex pattern to detect new [fine-grained PATs](https://github.blog/changelog/2022-10-18-introducing-fine-grained-personal-access-tokens/) --- src/Composer/Util/Url.php | 2 +- tests/Composer/Test/Util/UrlTest.php | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/Composer/Util/Url.php b/src/Composer/Util/Url.php index c2ee92465..23121808d 100644 --- a/src/Composer/Util/Url.php +++ b/src/Composer/Util/Url.php @@ -116,7 +116,7 @@ class Url $url = Preg::replaceCallback('{^(?P[a-z0-9]+://)?(?P[^:/\s@]+):(?P[^@\s/]+)@}i', function ($m) { // if the username looks like a long (12char+) hex string, or a modern github token (e.g. ghp_xxx) we obfuscate that - if (Preg::isMatch('{^([a-f0-9]{12,}|gh[a-z]_[a-zA-Z0-9_]+)$}', $m['user'])) { + if (Preg::isMatch('{^([a-f0-9]{12,}|gh[a-z]_[a-zA-Z0-9_]+|github_pat_[a-zA-Z0-9_]+)$}', $m['user'])) { return $m['prefix'].'***:***@'; } diff --git a/tests/Composer/Test/Util/UrlTest.php b/tests/Composer/Test/Util/UrlTest.php index 66165b4b8..19637b647 100644 --- a/tests/Composer/Test/Util/UrlTest.php +++ b/tests/Composer/Test/Util/UrlTest.php @@ -87,6 +87,7 @@ class UrlTest extends TestCase array('https://example.org/foo/bar?access_token=***', 'https://example.org/foo/bar?access_token=abcdef'), array('https://example.org/foo/bar?foo=bar&access_token=***', 'https://example.org/foo/bar?foo=bar&access_token=abcdef'), array('https://***:***@github.com/acme/repo', 'https://ghp_1234567890abcdefghijklmnopqrstuvwxyzAB:x-oauth-basic@github.com/acme/repo'), + array('https://***:***@github.com/acme/repo', 'https://github_pat_1234567890abcdefghijkl_1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW:x-oauth-basic@github.com/acme/repo'), // without scheme array('foo:***@example.org/', 'foo:bar@example.org/'), array('foo@example.org/', 'foo@example.org/'),