fix: redact proxy credentials when logging the proxy URL from env

[Shubham-Padkonde]

Summary

Redact proxy credentials in environment-variable logs and Socket Mode connection errors, including scheme-less and malformed URLs, while retaining the original proxy value for connections. Fixes #1826.

Testing

The proxy regression module passes all 9 tests; malformed URL and Socket Mode exception cases fail before the fix. Project lint passes for 455 files. Full SDK validation was not run for this branch.

Category

• slack_sdk.web.WebClient (sync/async) (Web API client)

• slack_sdk.webhook.WebhookClient (sync/async) (Incoming Webhook, response_url sender)

• slack_sdk.socket_mode (Socket Mode client)

• slack_sdk.signature (Request Signature Verifier)

• slack_sdk.oauth (OAuth Flow Utilities)

• slack_sdk.models (UI component builders)

• slack_sdk.scim (SCIM API client)

• slack_sdk.audit_logs (Audit Logs API client)

• slack_sdk.rtm_v2 (RTM client)

• /docs (Documents)

• /tutorial (PythOnBoardingBot tutorial)

• tests/integration_tests (Automated tests for this library)

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.

• I've read and agree to the Code of Conduct.

• I've run python3 -m venv .venv && source .venv/bin/activate && ./scripts/run_validation.sh after making the changes.

Prepared with OpenAI Codex assistance. The full-validation and contributor-agreement checkboxes are left unchecked; the scoped validation above is the work actually performed.

[WilliamBergamin]

Hi @Shubham-Padkonde, thanks for your interest in our project!

I pulled the branch and tested it locally. Since this is a security fix I'd like it to hold up against every proxy value we actually accept, and a few inputs still leak the password. Because of that, we can't merge it as it stands. Here's what I found:

1. Proxy URLs without a scheme are logged unchanged

bob:secret@proxy.example.com:3128 is a valid proxy for the sync clients (urllib's ProxyHandler parses it to user bob, password secret). But urlsplit reads bob as the scheme and leaves the netloc empty. There's no @ in the netloc, so _redact_credentials returns the original string, password included.

2. Unencoded /, # or ? in the password is logged unchanged

http://bob:pa/ss@proxy:8080, http://bob:pa#ss@proxy:8080 and http://bob:pa?ss@proxy:8080 all end the netloc before the @, so they hit the same "no @ in netloc" path. These URLs are technically malformed, but a redactor should fail closed. If we can't confidently find the user info, we should redact more, not less.

3. The same leak exists in Socket Mode

slack_sdk/socket_mode/builtin/internals.py raises Failed to connect to the proxy (proxy: {proxy}, ...) with the full URL. connection.py then logs that message at error level. I pointed it at a local proxy that returns 407, and the message included http://bob:secret@.... It'd be great to close this in the same PR so #1826 is fully resolved.

Suggestions

• Make the redaction fail closed. If the value contains @ anywhere, replace everything between the optional scheme:// and the last @ with ***, whatever urlsplit returns. Over-redacting a log line is harmless, and under-redacting is the bug we're fixing.
• Use the same helper in the Socket Mode exception message.
• Add tests for:
  • the scheme-less form
  • unencoded /, # and ? in the password
  • a username with no password (http://token@proxy:8080)
  • the (unparsable URL) branch

[Shubham-Padkonde]

Fixed in 48c82ca: credential redaction now uses the last @, including scheme-less URLs and malformed password delimiters. Socket Mode proxy errors use the same helper. Added username-only, multiple-@, malformed-URL, and proxy-407 regressions. The new tests reproduced five failures before the fix; all nine tests now pass, and project lint passes. Full SDK validation was not run. Prepared with Codex assistance.