URL passwords leak into logs via http.Get error messages #12

Summary

Destination.UrlString() carefully redacts the password component of a URL with [...] for logging (destinations.go:46-50). That redaction is undone whenever the HTTP check fails: LogDestinationError logs the raw error returned by http.Get(dest.URL), and Go's *url.Error.Error() embeds the original URL string — userinfo included — verbatim.

The deliberate password-suppression elsewhere in the codebase signals that this is a real concern, not a hypothetical one.

Code

https.go:8-18:

func HTTPS(dest *Destination) bool {
	dest.Increment("connectivity.http", []string{})
	_, err := http.Get(dest.URL)                          // dest.URL contains userinfo
	if err != nil {
		dest.Increment("connectivity.http.error", []string{})
		LogDestinationError(dest, "Failed HTTP GET", err) // err.Error() leaks the URL
		return false
	}
	...
}

logging.go:9-11:

func LogDestinationError(dest *Destination, msg string, err error) {
	log.Printf("%s %s %s: %s", GetLocalIPs(), dest, msg, err)
}

The wrapped *url.Error.Error() returns "Get \"<full URL with creds>\": <inner err>".

Reproduction

# connectivity.yml
HTTP: http://admin:hunter2@host.invalid/health

$ connectivity check
... [host][HTTP:] Failed HTTP GET: Get "http://admin:hunter2@host.invalid/health": dial tcp: lookup host.invalid: no such host

The password is in plaintext in the log line, in operator log aggregators, in CI output, etc.

Impact

Credentials embedded in a URL (a not-uncommon pattern for quick health checks of authenticated endpoints) are persisted to logs whenever the endpoint fails. Anyone with log read access can recover the password.

Suggested fix

Strip userinfo from the URL before passing to http.Get, send credentials as an explicit Authorization header on the http.Request, and never log the URL field of a *url.Error. Example:

parsed, _ := url.Parse(dest.URL)
user := parsed.User
parsed.User = nil
req, _ := http.NewRequest("GET", parsed.String(), nil)
if user != nil {
    if pw, ok := user.Password(); ok {
        req.SetBasicAuth(user.Username(), pw)
    }
}
resp, err := client.Do(req)
if err != nil {
    var ue *url.Error
    if errors.As(err, &ue) {
        ue.URL = parsed.Redacted()   // or just dest.UrlString()
    }
    ...
}

Relates to #7 (other HTTP check defects).