What is wrong: the check from #166 in parseS3URL/parseRcloneURL (internal/storage/url.go) rejects only the outer URL's user info and unknown query parameters. User info inside the endpoint= value, and rclone connection-string parameters in the remote name (remote,param=value), pass.
How it was shown:storage_url: "s3://bkt/p?endpoint=https://AKIAUSERINFO:SECRETUSERINFO@127.0.0.1:1" is accepted, and info prints it in "Location:" and "Storage URL:", remote info in "Location:". rclone://loc,description=SECRETPARAMVALUE//path is accepted and passed to rclone; the parameter appears in info and in snapshot create's upload lines.
Definition of done
Both forms are rejected when the config loads, without echoing the value, as the outer user info is.
Tests cover both.
Model: opus-5-5
Found by the defect hunt in https://git.eeqj.de/sneak/vaultik/issues/288 (part 5).
**What is wrong:** the check from https://git.eeqj.de/sneak/vaultik/issues/166 in `parseS3URL`/`parseRcloneURL` (`internal/storage/url.go`) rejects only the outer URL's user info and unknown query parameters. User info inside the `endpoint=` value, and rclone connection-string parameters in the remote name (`remote,param=value`), pass.
**How it was shown:** `storage_url: "s3://bkt/p?endpoint=https://AKIAUSERINFO:SECRETUSERINFO@127.0.0.1:1"` is accepted, and `info` prints it in "Location:" and "Storage URL:", `remote info` in "Location:". `rclone://loc,description=SECRETPARAMVALUE//path` is accepted and passed to rclone; the parameter appears in `info` and in `snapshot create`'s upload lines.
**Definition of done**
- Both forms are rejected when the config loads, without echoing the value, as the outer user info is.
- Tests cover both.
Model: opus-5-5
clawbot
self-assigned this 2026-10-13 00:47:21 +02:00
Built in #352: an s3:// URL whose endpoint= value holds user info, and an rclone:// URL whose remote name carries remote,param=value parameters, are now refused when the storage URL is parsed, without the value in the error.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/vaultik/pulls/352: an `s3://` URL whose `endpoint=` value holds user info, and an `rclone://` URL whose remote name carries `remote,param=value` parameters, are now refused when the storage URL is parsed, without the value in the error.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found by the defect hunt in #288 (part 5).
What is wrong: the check from #166 in
parseS3URL/parseRcloneURL(internal/storage/url.go) rejects only the outer URL's user info and unknown query parameters. User info inside theendpoint=value, and rclone connection-string parameters in the remote name (remote,param=value), pass.How it was shown:
storage_url: "s3://bkt/p?endpoint=https://AKIAUSERINFO:SECRETUSERINFO@127.0.0.1:1"is accepted, andinfoprints it in "Location:" and "Storage URL:",remote infoin "Location:".rclone://loc,description=SECRETPARAMVALUE//pathis accepted and passed to rclone; the parameter appears ininfoand insnapshot create's upload lines.Definition of done
Model: opus-5-5
Built in #352: an
s3://URL whoseendpoint=value holds user info, and anrclone://URL whose remote name carriesremote,param=valueparameters, are now refused when the storage URL is parsed, without the value in the error.Model: opus-5-5