fix(redis): do not log the Redis password

[bakiburakogun]

The problem

RedisAdapter.createRedisClient() logs the configured Redis URL verbatim every time the websocket server starts. On any deployment that authenticates to Redis, that writes the password into the journal in clear text:

Creating Redis client with URL: redis://:s3cret@10.0.0.5:6379

We hit this on a production install: the password we had just put in a 0600 environment file showed up in journalctl a second later, where it is readable by anyone who can read the journal and by whatever ships logs off the box.

The change

Redact the credentials before logging. The host and port, which are the useful part of the line, stay visible:

Creating Redis client with URL: redis://:***@10.0.0.5:6379

A URL that cannot be parsed logs a placeholder rather than the raw string, so a malformed value with a secret in it does not leak either.

Testing

redis://:s3cret@10.0.0.5:6379          -> redis://:***@10.0.0.5:6379
redis://user:pass@host:6379/2          -> redis://***:***@host:6379/2
redis://10.0.0.5:6379                  -> redis://10.0.0.5:6379   (unchanged)
unix:///var/run/redis.sock             -> unix:///var/run/redis.sock (unchanged)
not-a-url                              -> <unparsable REDIS_URL>

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

[hweihwang]

Thanks for fixing this. The valid URL cases work. I left one comment on malformed URLs: that leak predates this PR, but the startup error still exposes the password.

Please add tests for the documented examples, encoded credentials, and startup errors. Keep the list of Redis URLs in #1318 covered too.

[hweihwang]

With redis://:test-password@, this helper hides the URL, but the next new URL(Config.REDIS_URL) throws an error containing the original value in input. main() then logs it, including the password.

Please return a configuration error without the raw URL and test the startup log, not just this helper.

[bakiburakogun]

You are right, and the hole was next to the one I closed rather than in it. new URL() hangs the value it was given on the error it throws, and main() prints that error, so the password came out through the crash path:

Failed to start server: TypeError: Invalid URL
    at new URL (node:internal/url:818:25)
  { code: 'ERR_INVALID_URL', input: 'redis://:test-password@' }

createRedisClient() now parses through a helper that raises REDIS_URL is not a valid URL and carries nothing from the configured value — no cause, so there is nothing to walk back to.

On the list of Redis URLs: I had to be careful there, because a comma is legal inside a password. redis://:test,password@localhost:6379 is a valid single node whose password is test,password, and splitting on every comma would have broken it in the redaction too. The value is only read as a list when it has more than one part and every part on its own is a URL with a scheme and a host. That is in splitRedisUrls() here, and #1318 will use the same helper to decide whether to build a cluster client rather than the includes(',') check you commented on there.

Tests are in tests/integration/redisUrlCredentials.spec.mjs, 29 of them:

• the two examples written down in .env.example and the README, plus rediss://, a unix socket, username only and password only;
• percent encoded credentials;
• the seed node list, with and without credentials on the first node;
• a comma inside the password and a comma inside the username, asserted to stay in one piece;
• the startup path rather than the helper: with a malformed URL, that the thrown error has no input, that util.inspect() of it does not contain the password, and that the line the server logs says <unparsable REDIS_URL>; with a valid one, that the logged line is the redacted URL;
• a sweep asserting the password never appears in the output for any of the shapes above.

Verified against the branch with the fix reverted: 11 of the 29 fail, including the malformed URL one. The full suite is 102 passing across 13 files, and eslint is clean on both files — note it was not before, since the two one line ifs I had written put the file two over its curly budget in eslint-suppressions.json. They have braces now.

Branch rebased onto current main, still one commit.