From a47c1536fcccd73ed7cdb89fff7d1c96d205b1b6 Mon Sep 17 00:00:00 2001
From: Johannes Marbach <n0-0ne+github@mailbox.org>
Date: Tue, 23 Jun 2026 11:34:47 +0200
Subject: [PATCH] Restrain logging of URL properties

---
 src/UrlParams.ts         |  3 ++-
 src/utils/redact.test.ts | 36 ++++++++++++++++++++++++++++++++++++
 src/utils/redact.ts      | 17 +++++++++++++++++
 3 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 src/utils/redact.test.ts
 create mode 100644 src/utils/redact.ts

diff --git a/src/UrlParams.ts b/src/UrlParams.ts
index f4ea840de..773aa4121 100644
--- a/src/UrlParams.ts
+++ b/src/UrlParams.ts
@@ -19,6 +19,7 @@ import { Config } from "./config/Config";
 import { type EncryptionSystem } from "./e2ee/sharedKeyManagement";
 import { E2eeType } from "./e2ee/e2eeType";
 import { platform } from "./Platform";
+import { redact } from "./utils/redact";
 
 interface RoomIdentifier {
   roomAlias: string | null;
@@ -494,7 +495,7 @@ export const computeUrlParams = (search = "", hash = ""): UrlParams => {
     "intent:",
     intent,
     "\nproperties:",
-    properties,
+    redact(properties, "password"),
     "configuration:",
     configuration,
   );
diff --git a/src/utils/redact.test.ts b/src/utils/redact.test.ts
new file mode 100644
index 000000000..a87a23690
--- /dev/null
+++ b/src/utils/redact.test.ts
@@ -0,0 +1,36 @@
+/*
+Copyright 2026 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE in the repository root for full details.
+*/
+
+import { expect, test } from "vitest";
+
+import { redact } from "./redact";
+
+test("empty object", () => {
+  expect(redact({})).to.deep.equal({});
+});
+
+test("no keys", () => {
+  expect(redact({ foo: "bar" })).to.deep.equal({ foo: "bar" });
+});
+
+test("redact one key", () => {
+  expect(redact({ foo: "bar" }, "foo")).to.deep.equal({ foo: "<redacted>" });
+});
+
+test("redact two keys", () => {
+  expect(redact({ foo: "bar", bar: "foo" }, "foo", "bar")).to.deep.equal({
+    foo: "<redacted>",
+    bar: "<redacted>",
+  });
+});
+
+test("no redaction of unrelated keys", () => {
+  expect(redact({ foo: "bar", bar: "foo" }, "foo")).to.deep.equal({
+    foo: "<redacted>",
+    bar: "foo",
+  });
+});
diff --git a/src/utils/redact.ts b/src/utils/redact.ts
new file mode 100644
index 000000000..7764aacb7
--- /dev/null
+++ b/src/utils/redact.ts
@@ -0,0 +1,17 @@
+/*
+Copyright 2026 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE in the repository root for full details.
+*/
+
+/**
+ * Redacts properties in the supplied object by replacing them with
+ * a constant value.
+ * @param obj Object in which to perform redaction
+ * @param keys Keys to be redacted in the object
+ * @returns A new object with the specified properties redacted
+ */
+export function redact<T extends object>(obj: T, ...keys: (keyof T)[]): T {
+  return { ...obj, ...Object.fromEntries(keys.map((k) => [k, "<redacted>"])) };
+}