Fix: Enabling username and passwords to be obfuscated

rq_dashboard/web.py

@@ -278,9 +278,9 @@ def get_queue_registry_jobs_count(queue_name, registry_name, offset, per_page):
 
 def escape_format_instance_list(url_list):
     if isinstance(url_list, (list, tuple)):
-        url_list = [re.sub(r"://:[^@]*@", "://:***@", x) for x in url_list]
+        url_list = [re.sub(r":\/\/[^@]*@", "://***:***@", x) for x in url_list]
     elif isinstance(url_list, string_types):
-        url_list = [re.sub(r"://:[^@]*@", "://:***@", url_list)]
+        url_list = [re.sub(r":\/\/[^@]*@", "://***:***@", url_list)]
     return url_list
 
 

tests/test_basic.py

@@ -5,6 +5,7 @@
 from rq import Queue, Worker, pop_connection, push_connection
 
 from rq_dashboard.cli import make_flask_app
+from rq_dashboard.web import escape_format_instance_list
 
 
 HTTP_OK = 200
@@ -107,6 +108,20 @@ def test_worker_version_field(self):
         w.register_death()
 
 
+    def test_instance_escaping(self):
+        expected_redis_instance = "redis://***:***@redis.example.com:6379"
+        self.assertEqual(
+            escape_format_instance_list(
+                [
+                    "redis://myuser:[email protected]:6379",
+                    "redis://:[email protected]:6379",
+                    "redis://:@redis.example.com:6379",
+                ]
+            ),
+            [expected_redis_instance, expected_redis_instance, expected_redis_instance],
+        )
+
+
 __all__ = [
     'BasicTestCase',
-]
+]