fix: redact proxy credentials when logging the proxy URL from env

[Shubham-Padkonde]

Summary

Redact proxy credentials in environment-variable logs and Socket Mode connection errors, including scheme-less and malformed URLs, while retaining the original proxy value for connections. Fixes #1826.

Testing

The exact published commit e29ccea passed the complete scripts/run_validation.sh on Linux / Python 3.14.7: 1,029 tests passed, five skipped; formatting/lint for 455 files and mypy for 107 files passed. The script ran unchanged in an isolated uv-created virtual environment.

The follow-up covers two additional credential paths: CONNECT trace logs redact generated Basic authentication and mixed-case custom Proxy-Authorization headers, while preserving transmitted request bytes; malformed proxy URL parsing raises a generic ValueError without exposing the sensitive chained exception. The trace regressions failed twice before the fix, and parsing/logging regressions failed in six cases before the fix. Tests cover explicit and default proxy ports and trace logging on/off.

Category

• slack_sdk.web.WebClient (sync/async) (Web API client)
• slack_sdk.webhook.WebhookClient (sync/async) (Incoming Webhook, response_url sender)
• slack_sdk.socket_mode (Socket Mode client)
• slack_sdk.signature (Request Signature Verifier)
• slack_sdk.oauth (OAuth Flow Utilities)
• slack_sdk.models (UI component builders)
• slack_sdk.scim (SCIM API client)
• slack_sdk.audit_logs (Audit Logs API client)
• slack_sdk.rtm_v2 (RTM client)
• /docs (Documents)
• /tutorial (PythOnBoardingBot tutorial)
• tests/integration_tests (Automated tests for this library)

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've run python3 -m venv .venv && source .venv/bin/activate && ./scripts/run_validation.sh after making the changes.

Prepared with OpenAI Codex assistance. Full validation is recorded above; personal contributor-agreement checkboxes remain for the contributor to complete.

[WilliamBergamin]

Hi @Shubham-Padkonde, thanks for your interest in our project!

I pulled the branch and tested it locally. Since this is a security fix I'd like it to hold up against every proxy value we actually accept, and a few inputs still leak the password. Because of that, we can't merge it as it stands. Here's what I found:

1. Proxy URLs without a scheme are logged unchanged

bob:secret@proxy.example.com:3128 is a valid proxy for the sync clients (urllib's ProxyHandler parses it to user bob, password secret). But urlsplit reads bob as the scheme and leaves the netloc empty. There's no @ in the netloc, so _redact_credentials returns the original string, password included.

2. Unencoded /, # or ? in the password is logged unchanged

http://bob:pa/ss@proxy:8080, http://bob:pa#ss@proxy:8080 and http://bob:pa?ss@proxy:8080 all end the netloc before the @, so they hit the same "no @ in netloc" path. These URLs are technically malformed, but a redactor should fail closed. If we can't confidently find the user info, we should redact more, not less.

3. The same leak exists in Socket Mode

slack_sdk/socket_mode/builtin/internals.py raises Failed to connect to the proxy (proxy: {proxy}, ...) with the full URL. connection.py then logs that message at error level. I pointed it at a local proxy that returns 407, and the message included http://bob:secret@.... It'd be great to close this in the same PR so #1826 is fully resolved.

Suggestions

• Make the redaction fail closed. If the value contains @ anywhere, replace everything between the optional scheme:// and the last @ with ***, whatever urlsplit returns. Over-redacting a log line is harmless, and under-redacting is the bug we're fixing.
• Use the same helper in the Socket Mode exception message.
• Add tests for:
  • the scheme-less form
  • unencoded /, # and ? in the password
  • a username with no password (http://token@proxy:8080)
  • the (unparsable URL) branch

[Shubham-Padkonde]

Fixed in 48c82ca: credential redaction now uses the last @, including scheme-less URLs and malformed password delimiters. Socket Mode proxy errors use the same helper. Added username-only, multiple-@, malformed-URL, and proxy-407 regressions. The new tests reproduced five failures before the fix; all nine tests now pass, and project lint passes. Full SDK validation was not run. Prepared with Codex assistance.