Remove logging of any SAS tokens in Actions/Cache and Actions/Artifact

packages/artifact/__tests__/artifactTwirpClient.test.ts

@@ -0,0 +1,124 @@
+import {ArtifactHttpClient} from '../src/internal/shared/artifact-twirp-client'
+import {setSecret} from '@actions/core'
+import {CreateArtifactResponse} from '../src/generated/results/api/v1/artifact'
+
+jest.mock('@actions/core', () => ({
+  setSecret: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn()
+}))
+
+describe('ArtifactHttpClient', () => {
+  let client: ArtifactHttpClient
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    process.env['ACTIONS_RUNTIME_TOKEN'] = 'test-token'
+    process.env['ACTIONS_RESULTS_URL'] = 'https://example.com'
+    client = new ArtifactHttpClient('test-agent')
+  })
+
+  afterEach(() => {
+    delete process.env['ACTIONS_RUNTIME_TOKEN']
+    delete process.env['ACTIONS_RESULTS_URL']
+  })
+
+  describe('maskSigUrl', () => {
+    it('should mask the sig parameter and set it as a secret', () => {
+      const url =
+        'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+
+      const maskedUrl = client.maskSigUrl(url)
+
+      expect(setSecret).toHaveBeenCalledWith('secret-token')
+      expect(maskedUrl).toBe(
+        'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=***'
+      )
+    })
+
+    it('should return the original URL if no sig parameter is found', () => {
+      const url = 'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z'
+
+      const maskedUrl = client.maskSigUrl(url)
+
+      expect(setSecret).not.toHaveBeenCalled()
+      expect(maskedUrl).toBe(url)
+    })
+
+    it('should handle sig parameter at the end of the URL', () => {
+      const url = 'https://example.com/upload?param1=value&sig=secret-token'
+
+      const maskedUrl = client.maskSigUrl(url)
+
+      expect(setSecret).toHaveBeenCalledWith('secret-token')
+      expect(maskedUrl).toBe('https://example.com/upload?param1=value&sig=***')
+    })
+
+    it('should handle sig parameter in the middle of the URL', () => {
+      const url = 'https://example.com/upload?sig=secret-token&param2=value'
+
+      const maskedUrl = client.maskSigUrl(url)
+
+      expect(setSecret).toHaveBeenCalledWith('secret-token&param2=value')
+      expect(maskedUrl).toBe('https://example.com/upload?sig=***')
+    })
+  })
+
+  describe('maskSecretUrls', () => {
+    it('should mask signed_upload_url', () => {
+      const spy = jest.spyOn(client, 'maskSigUrl')
+      const response = {
+        ok: true,
+        signed_upload_url:
+          'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+      }
+
+      client.maskSecretUrls(response)
+
+      expect(spy).toHaveBeenCalledWith(
+        'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+      )
+    })
+
+    it('should mask signed_download_url', () => {
+      const spy = jest.spyOn(client, 'maskSigUrl')
+      const response = {
+        signed_url:
+          'https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+      }
+
+      client.maskSecretUrls(response)
+
+      expect(spy).toHaveBeenCalledWith(
+        'https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+      )
+    })
+
+    it('should not call maskSigUrl if URLs are missing', () => {
+      const spy = jest.spyOn(client, 'maskSigUrl')
+      const response = {} as CreateArtifactResponse
+
+      client.maskSecretUrls(response)
+
+      expect(spy).not.toHaveBeenCalled()
+    })
+
+    it('should handle both URL types when present', () => {
+      const spy = jest.spyOn(client, 'maskSigUrl')
+      const response = {
+        signed_upload_url: 'https://example.com/upload?sig=secret-token1',
+        signed_url: 'https://example.com/download?sig=secret-token2'
+      }
+
+      client.maskSecretUrls(response)
+
+      expect(spy).toHaveBeenCalledTimes(2)
+      expect(spy).toHaveBeenCalledWith(
+        'https://example.com/upload?sig=secret-token1'
+      )
+      expect(spy).toHaveBeenCalledWith(
+        'https://example.com/download?sig=secret-token2'
+      )
+    })
+  })
+})

packages/artifact/src/internal/shared/artifact-twirp-client.ts

@@ -1,6 +1,6 @@
 import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
-import {info, debug} from '@actions/core'
+import {setSecret, info, debug} from '@actions/core'
 import {ArtifactServiceClientJSON} from '../../generated'
 import {getResultsServiceUrl, getRuntimeToken} from './config'
 import {getUserAgentString} from './user-agent'
@@ -16,7 +16,7 @@ interface Rpc {
   ): Promise<object | Uint8Array>
 }
 
-class ArtifactHttpClient implements Rpc {
+export class ArtifactHttpClient implements Rpc {
   private httpClient: HttpClient
   private baseUrl: string
   private maxAttempts = 5
@@ -70,6 +70,38 @@ class ArtifactHttpClient implements Rpc {
     }
   }
 
+  /**
+   * Masks the `sig` parameter in a URL and sets it as a secret.
+   * @param url The URL containing the `sig` parameter.
+   * @returns A masked URL where the sig parameter value is replaced with '***' if found,
+   *          or the original URL if no sig parameter is present.
+   */
+  maskSigUrl(url: string): string {
+    const sigIndex = url.indexOf('sig=')
+    if (sigIndex !== -1) {
+      const sigValue = url.substring(sigIndex + 4)
+      setSecret(sigValue)
+      return `${url.substring(0, sigIndex + 4)}***`
+    }
+    return url
+  }
+
+  maskSecretUrls(body): void {
+    if (typeof body === 'object' && body !== null) {
+      if (
+        'signed_upload_url' in body &&
+        typeof body.signed_upload_url === 'string'
+      ) {
+        this.maskSigUrl(body.signed_upload_url)
+      }
+      if ('signed_url' in body && typeof body.signed_url === 'string') {
+        this.maskSigUrl(body.signed_url)
+      }
+    } else {
+      debug('body is not an object or is null')
+    }
+  }
+
   async retryableRequest(
     operation: () => Promise<HttpClientResponse>
   ): Promise<{response: HttpClientResponse; body: object}> {
@@ -86,6 +118,7 @@ class ArtifactHttpClient implements Rpc {
         debug(`[Response] - ${response.message.statusCode}`)
         debug(`Headers: ${JSON.stringify(response.message.headers, null, 2)}`)
         const body = JSON.parse(rawBody)
+        this.maskSecretUrls(body)
         debug(`Body: ${JSON.stringify(body, null, 2)}`)
         if (this.isSuccessStatusCode(statusCode)) {
           return {response, body}

packages/cache/__tests__/cacheTwirpClient.test.ts

@@ -0,0 +1,125 @@
+import {CacheServiceClient} from '../src/internal/shared/cacheTwirpClient'
+import {setSecret} from '@actions/core'
+
+jest.mock('@actions/core', () => ({
+  setSecret: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn()
+}))
+
+describe('CacheServiceClient', () => {
+  let client: CacheServiceClient
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    process.env['ACTIONS_RUNTIME_TOKEN'] = 'test-token'
+    client = new CacheServiceClient('test-agent')
+  })
+
+  afterEach(() => {
+    delete process.env['ACTIONS_RUNTIME_TOKEN']
+  })
+
+  describe('maskSigUrl', () => {
+    it('should mask the sig parameter and set it as a secret', () => {
+      const url =
+        'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+
+      const maskedUrl = client.maskSigUrl(url)
+
+      expect(setSecret).toHaveBeenCalledWith('secret-token')
+      expect(maskedUrl).toBe(
+        'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=***'
+      )
+    })
+
+    it('should return the original URL if no sig parameter is found', () => {
+      const url = 'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z'
+
+      const maskedUrl = client.maskSigUrl(url)
+
+      expect(setSecret).not.toHaveBeenCalled()
+      expect(maskedUrl).toBe(url)
+    })
+
+    it('should handle sig parameter at the end of the URL', () => {
+      const url = 'https://example.com/upload?param1=value&sig=secret-token'
+
+      const maskedUrl = client.maskSigUrl(url)
+
+      expect(setSecret).toHaveBeenCalledWith('secret-token')
+      expect(maskedUrl).toBe('https://example.com/upload?param1=value&sig=***')
+    })
+
+    it('should handle sig parameter in the middle of the URL', () => {
+      const url = 'https://example.com/upload?sig=secret-token&param2=value'
+
+      const maskedUrl = client.maskSigUrl(url)
+
+      expect(setSecret).toHaveBeenCalledWith('secret-token&param2=value')
+      expect(maskedUrl).toBe('https://example.com/upload?sig=***')
+    })
+  })
+
+  describe('maskSecretUrls', () => {
+    it('should mask signed_upload_url', () => {
+      const spy = jest.spyOn(client, 'maskSigUrl')
+      const body = {
+        signed_upload_url: 'https://example.com/upload?sig=secret-token',
+        key: 'test-key',
+        version: 'test-version'
+      }
+
+      client.maskSecretUrls(body)
+
+      expect(spy).toHaveBeenCalledWith(
+        'https://example.com/upload?sig=secret-token'
+      )
+    })
+
+    it('should mask signed_download_url', () => {
+      const spy = jest.spyOn(client, 'maskSigUrl')
+      const body = {
+        signed_download_url: 'https://example.com/download?sig=secret-token',
+        key: 'test-key',
+        version: 'test-version'
+      }
+
+      client.maskSecretUrls(body)
+
+      expect(spy).toHaveBeenCalledWith(
+        'https://example.com/download?sig=secret-token'
+      )
+    })
+
+    it('should mask both URLs when both are present', () => {
+      const spy = jest.spyOn(client, 'maskSigUrl')
+      const body = {
+        signed_upload_url: 'https://example.com/upload?sig=secret-token1',
+        signed_download_url: 'https://example.com/download?sig=secret-token2'
+      }
+
+      client.maskSecretUrls(body)
+
+      expect(spy).toHaveBeenCalledTimes(2)
+      expect(spy).toHaveBeenCalledWith(
+        'https://example.com/upload?sig=secret-token1'
+      )
+      expect(spy).toHaveBeenCalledWith(
+        'https://example.com/download?sig=secret-token2'
+      )
+    })
+
+    it('should not call maskSigUrl when URLs are missing', () => {
+      const spy = jest.spyOn(client, 'maskSigUrl')
+      const body = {
+        key: 'test-key',
+        version: 'test-version'
+      }
+
+      client.maskSecretUrls(body)
+
+      expect(spy).not.toHaveBeenCalled()
+    })
+  })
+})

packages/cache/package.json

@@ -49,6 +49,7 @@
     "semver": "^6.3.1"
   },
   "devDependencies": {
+    "@types/node": "^22.13.9",
     "@types/semver": "^6.0.0",
     "typescript": "^5.2.2"
   }