🛡️ Sentinel: [HIGH] Fix DSN credential leak via urlsplit bypass

.jules/sentinel.md

@@ -2,3 +2,8 @@
 **Vulnerability:** User-provided string fields (like project and connection names) lacked strict validation against control characters, only relying on length constraints.
 **Learning:** This could potentially lead to Log Injection (CRLF injection), Null Byte Injection, or terminal escape injection if these strings are subsequently logged or rendered directly.
 **Prevention:** Use explicit regex validation `pattern=r'^[^\x00-\x1F\x7F]+$'` on Pydantic string fields to strictly reject control characters.
+
+## 2025-02-18 - Credential Leak via Malformed DSN (urlsplit behavior)
+**Vulnerability:** Python's `urllib.parse.urlsplit` fails to correctly populate the `netloc` component (and thus the `password` property) for DSN strings that do not contain `://` (e.g., `postgres:user:password@host/db`) or use non-standard schemes with underscores (e.g., `snowflake_invalid://`). As a result, credentials embedded in these types of DSNs bypassed the backend redaction logic (`dsn_redaction.py`) and could be leaked into error messages.
+**Learning:** `urlsplit` places credentials in the `path` component instead of `netloc` for non-standard DSNs lacking `://`, rendering standard property access (`parsed.password`) useless for extraction.
+**Prevention:** In DSN redaction or validation utilities, always include a fallback mechanism to detect and modify the scheme (e.g., substituting with a valid one like `http://` before parsing) to ensure `urlsplit` properly extracts secrets from these edge-case connection strings.

CHANGELOG.md

@@ -7,3 +7,4 @@
 - [FE] `autoInfer.ts`에 대한 단위 테스트 및 UI 컴포넌트 단위 테스트를 추가하여 100% 테스트 커버리지를 유지합니다.
 - [FE] ⬇️ **DBML Export**: ERD 다이어그램을 DBML (Database Markup Language) 형식으로 내보낼 수 있는 기능을 추가했습니다. 상단의 DBML 버튼을 클릭하여 다운로드할 수 있습니다.
 - [FE] 📚 **Data Dictionary Export**: ERD 테이블/컬럼 메타데이터를 CSV 및 Markdown으로 내보내며, CSV formula injection과 Markdown 렌더링 escape를 적용했습니다.
+- [BE] 🛡️ **보안**: `urllib.parse.urlsplit`가 `://`가 없거나 언더스코어가 포함된 비표준 DSN 문자열을 파싱할 때 인증 정보가 `netloc` 대신 `path`로 유출되어 로그나 에러 메시지에 노출되는 보안 취약점을 수정했습니다.

backend/app/dsn_redaction.py

@@ -45,9 +45,13 @@ def _password_candidates_from_dsn(dsn: str) -> set[str]:
     password: str | None = None
     try:
         parsed = urlsplit(dsn)
-        if "://" in dsn and not parsed.netloc:
-            # ponytail: keep urlsplit; only swap the non-RFC scheme so userinfo parses.
-            parsed = urlsplit("http://" + dsn.split("://", 1)[1])
+        if not parsed.netloc:
+            if "://" in dsn:
+                # ponytail: keep urlsplit; only swap the non-RFC scheme so userinfo parses.
+                parsed = urlsplit("http://" + dsn.split("://", 1)[1])
+            elif ":" in dsn:
+                # urlsplit fails to extract netloc if scheme lacks :// (e.g. postgres:user:pass@host)
+                parsed = urlsplit("http://" + dsn.split(":", 1)[1])
         netloc = parsed.netloc
         password = parsed.password
         query = parsed.query

backend/tests/test_dsn_redaction.py

@@ -43,3 +43,13 @@ def test_malformed_dsn_still_redacts_embedded_secrets() -> None:
     assert "s3cr3t" not in redacted
     assert "q/secret" not in redacted
     assert "password=***" in redacted
+
+def test_redacts_dsn_without_slashes() -> None:
+    dsn = "postgres:user:s3cr3t@db.example.com/app?password=q%2Fsecret"
+    error = f"driver failed for s3cr3t with password=q/secret while using {dsn}"
+
+    redacted = redact_dsn_error_message(error, dsn)
+
+    assert "s3cr3t" not in redacted
+    assert "q/secret" not in redacted
+    assert "password=***" in redacted