add SanitizeURL hook for safe request masking before logging

[ExcpOccured]

Summary

Adds a SanitizeURL hook to the Test struct, allowing users to modify the request (e.g., mask API keys) before logging or reporting.

---

Motivation

While using cute for integration tests, we found that sensitive query params like ?key=... were exposed in Allure reports.
We tried several approaches without library changes, but none masked the URLs in cute's built-in logs.

---

Approaches we tried

Example 1: Logging masked URL via Middleware

test.Middleware = &cute.Middleware{
    BeforeT: []cute.BeforeExecuteT{
        func(t cute.T, req *http.Request) error {
            safe := regexp.MustCompile(`key=[^&]+`).ReplaceAllString(req.URL.String(), "key=****")
            if stepper, ok := any(t).(interface {
                WithNewStep(name string, action func(stepCtx provider.StepCtx))
            }); ok {
                stepper.WithNewStep("Log masked URL", func(stepCtx provider.StepCtx) {
                    stepCtx.WithNewAttachment("Masked URL", allure.Text, []byte(safe))
                })
            }
            return nil
        },
    },
}

Worked: Added an Allure attachment.
Problem: Did not affect cute's internal request logging.

---

Example 2: Temporarily replacing req.URL.RawQuery

BeforeExecuteT: func(t cute.T, req *http.Request) error {
    original := req.URL.RawQuery
    req.URL.RawQuery = regexp.MustCompile(`key=[^&]+`).ReplaceAllString(original, "key=****")
    // log something
    req.URL.RawQuery = original
    return nil
},

Worked: Controlled masked URL.
Problem: Too late — cute had already logged the request.

---

What’s added

• SanitizeHook type with doc.
• Sanitizer field on Test.
• Call to hook inside createRequest().
• Unit test TestSanitizeURLHook.
• Small helper sanitizeKeyParam().

---

Example usage

test := &cute.Test{
    SanitizeURL: func(req *http.Request) {
        q := req.URL.Query()
        q.Set("key", "****")
        req.URL.RawQuery = q.Encode()
    },
}

---

Notes

• This feature is opt-in.
• It minimally affects the codebase.
• Open to feedback on placement or naming.

Thanks for reviewing!

[siller174]

Hello, thank you for your PR.
But looks like you sanitize the request too early because the request is used in further code.

cute/test.go

Line 407 in 852c9ca

resp, errs := it.makeRequest(t, req)

M.b. It's better to move it to

cute/roundtripper.go

Line 145 in 059c650

func (it *Test) addInformationRequest(t T, req *http.Request) error {

?

[siller174]

Also, could you please add builder for it to

cute/interface.go

Line 187 in 059c650

type RequestParams interface {

?

[ExcpOccured]

Hello, thank you for your PR. But looks like you sanitize the request too early because the request is used in further code.

cute/test.go

Line 407 in 852c9ca

resp, errs := it.makeRequest(t, req)

M.b. It's better to move it to

cute/roundtripper.go

Line 145 in 059c650

func (it *Test) addInformationRequest(t T, req *http.Request) error {

?

Hi! Thanks a lot for your suggestion regarding moving the Sanitizer call into addInformationRequest.
I actually tried this approach, but it leads to an important issue

The problem is that addInformationRequest is called after the request has already been sent over the network using httpClient.Do(req).
So by the time we reach addInformationRequest, the original (non-masked) URL has:

• Already been passed to httpClient
• Already been used in the curl command we generate
• Already been attached to the test report

As a result, applying the Sanitizer only in addInformationRequest means we are masking the URL too late - the sensitive data has already been logged and sent in the real request.

[ExcpOccured]

Also, could you please add builder for it to

cute/interface.go

Line 187 in 059c650

type RequestParams interface {

?

Yes, thanks for your comment, builder has been implemented - 1fa8ac8

[siller174]

Hello, thank you again for your PR. I moved and modified your PR to https://github.com/ozontech/cute/pull/90/files. Could you please check it?