Sanitize network errors

Author: chrmarti

extensions/copilot/src/extension/log/vscode-node/test/sanitizeNetworkError.spec.ts

@@ -39,6 +39,14 @@ describe('sanitizeNetworkErrorForTelemetry', () => {
 		);
 	});
 
+	test('strips credentials with @ in URL userinfo', () => {
+		expect(sanitizeNetworkErrorForTelemetry(
+			'https://fictional-user@example.com:fictional-pass@proxy.fictional.example.com:8080/path'
+		)).toBe(
+			'https://<credentials>@<host>:8080/path'
+		);
+	});
+
 	test('replaces IPv4 addresses', () => {
 		expect(sanitizeNetworkErrorForTelemetry(
 			'connect ETIMEDOUT 10.20.30.40:443'
@@ -91,6 +99,14 @@ describe('sanitizeNetworkErrorForTelemetry', () => {
 		);
 	});
 
+	test('replaces full IPv6 addresses', () => {
+		expect(sanitizeNetworkErrorForTelemetry(
+			'connect ENETUNREACH 2001:db8:85a3:0:0:8a2e:370:7334:443'
+		)).toBe(
+			'connect ENETUNREACH <ip>:443'
+		);
+	});
+
 	test('does not match non-IPv6 double colons', () => {
 		expect(sanitizeNetworkErrorForTelemetry(
 			'net::ERR_SOCKET_NOT_CONNECTED'
@@ -115,6 +131,30 @@ describe('sanitizeNetworkErrorForTelemetry', () => {
 		);
 	});
 
+	test('strips credentials with @ in password', () => {
+		expect(sanitizeNetworkErrorForTelemetry(
+			'Failed to establish a socket connection to proxies: PROXY fictional-user:P%40ss@fictional-proxy.example.com:8080'
+		)).toBe(
+			'Failed to establish a socket connection to proxies: PROXY <credentials>@<host>:8080'
+		);
+	});
+
+	test('strips credentials with email as username', () => {
+		expect(sanitizeNetworkErrorForTelemetry(
+			'Failed to establish a socket connection to proxies: PROXY fictional.user@example.com:fictional-pass@fictional-proxy.example.com:8080'
+		)).toBe(
+			'Failed to establish a socket connection to proxies: PROXY <credentials>@<host>:8080'
+		);
+	});
+
+	test('strips credentials with multiple @ signs', () => {
+		expect(sanitizeNetworkErrorForTelemetry(
+			'Failed to establish a socket connection to proxies: HTTPS fictional-id:fictional-pass@fictional-realm@fictional-proxy.example.com:80'
+		)).toBe(
+			'Failed to establish a socket connection to proxies: HTTPS <credentials>@<host>:80'
+		);
+	});
+
 	test('handles multiple proxies with credentials', () => {
 		expect(sanitizeNetworkErrorForTelemetry(
 			'Failed to establish a socket connection to proxies: PROXY testuser:testpass@proxy1.fictional.example.com:8080; PROXY proxy2.fictional.example.com:8080; DIRECT'

extensions/copilot/src/platform/log/common/logService.ts

@@ -409,13 +409,15 @@ export function collectSingleLineErrorMessage(e: any, includeDetails = false): s
  */
 export function sanitizeNetworkErrorForTelemetry(message: string): string {
 	// Strip credentials and host from proxy result strings (e.g., "PROXY user:pass@host" → "PROXY <credentials>@<host>")
-	message = message.replace(/(\b(?:PROXY|HTTPS?|SOCKS[45]?)\s+)[^\s@]+@([^\s:\/]+)/gi, '$1<credentials>@<host>');
+	message = message.replace(/(\b(?:PROXY|HTTPS?|SOCKS[45]?)\s+)[^\s]+@([^\s:\/]+)/gi, '$1<credentials>@<host>');
 	// Strip host from proxy result strings without credentials (e.g., "PROXY host:8080" → "PROXY <host>:8080")
 	message = message.replace(/(\b(?:PROXY|HTTPS?|SOCKS[45]?)\s+)([a-zA-Z0-9][-a-zA-Z0-9.]*)/gi, '$1<host>');
 	// Strip credentials and host from URLs (e.g., "://user:pass@host" → "://<credentials>@<host>")
-	message = message.replace(/(\/\/)[^\s/@]+@([^\s:\/]+)/g, '$1<credentials>@<host>');
+	message = message.replace(/(\/\/)[^\s/]+@([^\s:\/]+)/g, '$1<credentials>@<host>');
 	// Replace IPv4 addresses, preserving the port if present
 	message = message.replace(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g, '<ip>');
+	// Replace IPv6 addresses (full form, e.g., "2001:db8:85a3:0:0:8a2e:370:7334")
+	message = message.replace(/(?<![a-zA-Z_:])(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?![a-zA-Z_])/g, '<ip>');
 	// Replace IPv6 addresses (compressed form with ::, e.g., "2001:db8::1" or "::1")
 	message = message.replace(/(?<![a-zA-Z_:])(?:(?:[0-9a-fA-F]{1,4}:){1,7}|:):[0-9a-fA-F:]*[0-9a-fA-F](?![a-zA-Z_])/g, '<ip>');
 	// Replace FQDNs (at least one dot, TLD of 2+ alpha chars), preserving the port if present