fix(admin): mask all stored configuration secrets and credential URLs

deploy/server-agent.py

@@ -94,6 +94,18 @@ def now():
     return datetime.now(timezone.utc).isoformat()
 
 
+def sensitive_url(key, value):
+    """URL credentials also occur in userinfo, query strings and fragments."""
+    if not key.endswith("_URL") or not value:
+        return False
+    try:
+        parsed = urlsplit(value)
+        return bool(parsed.username or parsed.password or parsed.query or parsed.fragment)
+    except ValueError:
+        # A malformed URL must not bypass masking.
+        return True
+
+
 class Agent:
     def __init__(self, deploy, mailbox, private):
         self.deploy, self.mailbox, self.private = deploy, mailbox, private
@@ -162,9 +174,12 @@ class Agent:
             key = item["key"]
             source = "env" if key in env else "local" if key in local else "default"
             effective = env.get(key, local.get(key, item["default_value"]))
+            secret = item["secret"] or any(sensitive_url(key, value) for value in
+                                          (env.get(key), local.get(key), item["default_value"]))
             def display(value):
-                return "••••••••" if item["secret"] and value else value
-            entries.append({**item, "env": display(env.get(key)), "local": display(local.get(key)),
+                return "••••••••" if secret and value else value
+            entries.append({**item, "secret": secret, "default_value": display(item["default_value"]),
+                            "env": display(env.get(key)), "local": display(local.get(key)),
                             "effective": display(effective), "source": source})
         effective = self.effective_revision()
         applied = self.load("applied-effective.json", None)