Maintain repeated credential parameters

packages/lib/src/helpers.ts

@@ -304,11 +304,12 @@ export function redactUrl(url: URL | string) {
 		return String(url);
 	}
 
-	for (const name of [...parsed.searchParams.keys()]) {
-		if (sensitiveSearchParams.has(name.toLowerCase())) {
-			parsed.searchParams.set(name, "REDACTED");
-		}
+	const searchParams = new URLSearchParams();
+	for (const [name, value] of parsed.searchParams) {
+		searchParams.append(name, sensitiveSearchParams.has(name.toLowerCase()) ? "REDACTED" : value);
 	}
+
+	parsed.search = searchParams.toString();
 	return parsed.toString();
 }
 

test/lib/helpers.js

@@ -256,7 +256,7 @@ describe("lib/helpers", function() {
 		it("should redact every occurrence of a repeated credential parameter", function() {
 			assert.equal(
 				lib.redactUrl("https://example.com/?token=first&token=second"),
-				"https://example.com/?token=REDACTED"
+				"https://example.com/?token=REDACTED&token=REDACTED"
 			);
 		});
 		it("should accept a URL object", function() {