Redact OAuth2 refresh token from authentication-failure exception message (CWE-532)

[Dreamweaver156191]

Summary

Fixes a CWE-532 (insertion of sensitive information into a log file) issue in RegistryAuthenticator: when an OAuth2-authenticated registry's token endpoint responds without a token/access_token field, the resulting RegistryAuthenticationFailedException message embedded the caller's actual OAuth2 refresh token in plaintext. That exception message flows to build output, which is routinely captured in CI logs.

A corresponding OSS VRP report for this issue is being prepared.

The problem

getAuthRequestParameters() builds the real OAuth2 token-exchange request body, including the actual refresh token:

+ "&grant_type=refresh_token&refresh_token="
+ Verify.verifyNotNull(credential).getPassword()

That's correct and necessary for the real HTTP request. The bug is that the same method's output was also reused when building a human-readable exception message on failure:

throw new RegistryAuthenticationFailedException(
    registryUrl, imageName,
    "Did not get token in authentication response from " + getAuthenticationUrl(...)
        + "; parameters: " + getAuthRequestParameters(credential, repositoryScopes));

This fires whenever the registry's auth server responds 200 without a token field — a realistic, non-malicious failure mode (misconfigured auth server, unexpected response shape, etc.), not something requiring an attacker.

The fix

Adds getRedactedAuthRequestParameters(), identical to getAuthRequestParameters() except the refresh token is replaced with the literal string <redacted>. The real (unredacted) method continues to be used for the actual request body sent to the registry — only the exception-message call site was switched to the redacted variant.

Testing

Manually verified with a local mock OAuth2 registry that responds 200 with no token field. Before this fix, the resulting exception message contained the real refresh token in plaintext. After this fix, it contains refresh_token=<redacted> instead, while the actual token exchange request itself is unaffected (still uses the real token).

Happy to add a JUnit test alongside this if preferred.

[gemini-code-assist]

Code Review

This pull request introduces a new method getRedactedAuthRequestParameters to redact the OAuth2 refresh token in human-readable outputs, such as exception messages, preventing sensitive credentials from leaking into build or CI logs. The reviewer suggested refactoring this method to avoid duplicating the OAuth2 request parameter structure by calling getAuthRequestParameters and replacing the sensitive token in the resulting string.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.