fix: url redact of multiple sshkey (#528)

* fix: url redact of multiple sshkey

* clean unrequired reassignment and add more tests

Author: dduzgun-security

url.go

@@ -9,7 +9,8 @@ import "net/url"
 // which is like url.String but replaces any password with "redacted".
 // Only the password in u.URL is redacted. This allows the library
 // to maintain compatibility with go1.14.
-// This port was also extended to redact SSH key from URL query parameter.
+// This port was also extended to redact all "sshkey" from URL query parameter
+// and replace them with "redacted".
 func RedactURL(u *url.URL) string {
 	if u == nil {
 		return ""
@@ -20,8 +21,11 @@ func RedactURL(u *url.URL) string {
 		ru.User = url.UserPassword(ru.User.Username(), "redacted")
 	}
 	q := ru.Query()
-	if q.Get("sshkey") != "" {
-		q.Set("sshkey", "redacted")
+	if q.Has("sshkey") {
+		values := q["sshkey"]
+		for i := range values {
+			values[i] = "redacted"
+		}
 		ru.RawQuery = q.Encode()
 	}
 	return ru.String()

url_test.go

@@ -83,7 +83,51 @@ func TestRedactURL(t *testing.T) {
 				Path:     "hashicorp/go-getter-test-private.git",
 				RawQuery: "sshkey=",
 			},
-			want: "ssh://[email protected]/hashicorp/go-getter-test-private.git?sshkey=",
+			want: "ssh://[email protected]/hashicorp/go-getter-test-private.git?sshkey=redacted",
+		},
+		{
+			name: "multiple SSH keys with no and non-empty values",
+			url: &url.URL{
+				Scheme:   "ssh",
+				User:     url.User("git"),
+				Host:     "github.com",
+				Path:     "hashicorp/go-getter-test-private.git",
+				RawQuery: "sshkey&sshkey=secretkey",
+			},
+			want: "ssh://[email protected]/hashicorp/go-getter-test-private.git?sshkey=redacted&sshkey=redacted",
+		},
+		{
+			name: "multiple SSH keys with all empty values",
+			url: &url.URL{
+				Scheme:   "ssh",
+				User:     url.User("git"),
+				Host:     "github.com",
+				Path:     "hashicorp/go-getter-test-private.git",
+				RawQuery: "sshkey&sshkey",
+			},
+			want: "ssh://[email protected]/hashicorp/go-getter-test-private.git?sshkey=redacted&sshkey=redacted",
+		},
+		{
+			name: "multiple SSH keys with mixed empty and blank values",
+			url: &url.URL{
+				Scheme:   "ssh",
+				User:     url.User("git"),
+				Host:     "github.com",
+				Path:     "hashicorp/go-getter-test-private.git",
+				RawQuery: "sshkey=&sshkey=secretkey",
+			},
+			want: "ssh://[email protected]/hashicorp/go-getter-test-private.git?sshkey=redacted&sshkey=redacted",
+		},
+		{
+			name: "multiple SSH keys in URL query parameter",
+			url: &url.URL{
+				Scheme:   "ssh",
+				User:     url.User("git"),
+				Host:     "github.com",
+				Path:     "hashicorp/go-getter-test-private.git",
+				RawQuery: "sshkey=secretkey1&sshkey=secretkey2",
+			},
+			want: "ssh://[email protected]/hashicorp/go-getter-test-private.git?sshkey=redacted&sshkey=redacted",
 		},
 	}