fix(appraisal): reject credentials embedded in RPC URLs

services/appraisal-api/src/config.test.ts

@@ -81,6 +81,15 @@ describe("configFromEnv valid configurations", () => {
     assert.equal(config.networkPassphrase, Networks.PUBLIC);
     assert.equal(config.asset, USDC_PUBNET_ADDRESS);
   });
+
+  test("accepts valid HTTP RPC URL control case", () => {
+    const config = configFromEnv({
+      ...MINIMAL_ENV,
+      RPC_URL: "http://localhost:8000/rpc",
+    });
+
+    assert.equal(config.rpcUrl, "http://localhost:8000/rpc");
+  });
 });
 
 describe("configFromEnv failure modes", () => {
@@ -158,4 +167,43 @@ describe("configFromEnv failure modes", () => {
       "RPC_URL",
     );
   });
+
+  test("rejects RPC URLs containing credentials without echoing them", () => {
+    const cases = [
+      {
+        url: "https://alice:secret123@rpc.example.com",
+        credentials: ["alice", "secret123"],
+      },
+      {
+        url: "https://alice@rpc.example.com",
+        credentials: ["alice"],
+      },
+      {
+        url: "https://:secret123@rpc.example.com",
+        credentials: ["secret123"],
+      },
+      {
+        url: "http://admin:pass@localhost:8000",
+        credentials: ["admin", "pass"],
+      },
+    ];
+
+    for (const { url, credentials } of cases) {
+      assert.throws(
+        () => configFromEnv({ ...MINIMAL_ENV, RPC_URL: url }),
+        (error: unknown) => {
+          assert.ok(error instanceof AppraisalConfigError);
+          assert.equal(error.variable, "RPC_URL");
+          assert.match(error.message, /must not contain credentials/);
+          for (const secret of credentials) {
+            assert.ok(
+              !error.message.includes(secret),
+              `Error message should not echo credential: ${secret}`,
+            );
+          }
+          return true;
+        },
+      );
+    }
+  });
 });

services/appraisal-api/src/config.ts

@@ -116,19 +116,28 @@ function parseRpcUrl(
     return DEFAULT_TESTNET_RPC_URL;
   }
 
+  let url: URL;
   try {
-    const url = new URL(value);
+    url = new URL(value);
     if (url.protocol !== "https:" && url.protocol !== "http:") {
       throw new Error("unsupported protocol");
     }
-    return url.toString().replace(/\/$/, "");
   } catch (cause) {
     throw new AppraisalConfigError(
       "RPC_URL",
       `must be a valid http(s) URL, got ${JSON.stringify(value)}`,
       { cause },
     );
   }
+
+  if (url.username || url.password) {
+    throw new AppraisalConfigError(
+      "RPC_URL",
+      "must not contain credentials",
+    );
+  }
+
+  return url.toString().replace(/\/$/, "");
 }
 
 function validateFacilitatorSecret(secret: string): void {