address codeql

Author: Matvezy

inference/core/roboflow_api.py

@@ -1015,6 +1015,21 @@ def _stream_url_to_cache(
                         if total_size_int:
                             total_mb = total_size_int / (1024 * 1024)
                             percent = (downloaded_bytes / total_size_int) * 100
+                            #sanitized -- strip query params, mask secrets
+                            def _sanitize_filename_value(filename: str) -> str:
+                                # Remove query params (everything after '?'), and mask common secrets if present
+                                clean_fn = filename.split("?")[0]
+                                # Mask api_key, service_secret if present in name
+                                for secret_pattern in ["api_key=", "service_secret="]:
+                                    if secret_pattern in clean_fn:
+                                        clean_fn = clean_fn.replace(secret_pattern, f"{secret_pattern}***")
+                                # If there remain obvious secrets (long hex strings), replace
+                                import re
+                                clean_fn = re.sub(r'[A-Za-z0-9]{32,}', '***', clean_fn)
+                                return clean_fn
+
+
+                            safe_filename = _sanitize_filename_value(filename)
                             progress_msg = (
                             f"Downloading {filename}: {downloaded_mb:.1f}MB / "
                             f"Downloading {safe_filename}: {downloaded_mb:.1f}MB / "