pypa · cjerdonek · Mar 1, 2019 · Feb 23, 2019 · Feb 24, 2019 · Feb 24, 2019
diff --git a/news/6295.bugfix b/news/6295.bugfix
@@ -0,0 +1 @@
+Redacts the URL of the extra index when `pip -v` to hide the user's password
diff --git a/src/pip/_internal/index.py b/src/pip/_internal/index.py
@@ -155,7 +155,7 @@ def _get_html_response(url, session):
     if _is_url_like_archive(url):
         _ensure_html_response(url, session=session)
 
-    logger.debug('Getting page %s', url)
+    logger.debug('Getting page %s', redact_password_from_url(url))
 
     resp = session.get(
         url,

diff --git a/tests/unit/test_index_html_page.py b/tests/unit/test_index_html_page.py
@@ -118,6 +118,34 @@ def test_get_html_response_no_head(url):
     ]
 
 
+def test_get_html_response_dont_log_clear_text_password(caplog):
+    """
+    `_get_html_response()` shouldn't log the full index's URL includoing the
+    user's password in clear text on DEBUG channel but only the redacted URL
+    """
+    session = mock.Mock(PipSession)
+
+    # Mock the headers dict to ensure it is accessed.
+    session.get.return_value = mock.Mock(headers=mock.Mock(**{
+        "get.return_value": "text/html",
+    }))
+
+    caplog.set_level(logging.DEBUG)
+
+    resp = _get_html_response(
+        "https://user:my_password@example.com/simple/", session=session
+    )
+
+    assert resp is not None
+
+    assert len(caplog.records) == 1
+    record = caplog.records[0]
+    assert record.levelname == 'DEBUG'
+    assert record.message.splitlines() == [
+        "Getting page https://user:****@example.com/simple/",
+    ]
+
+
 @pytest.mark.parametrize(
     "url, vcs_scheme",
     [
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Redacts the URL of the extra index when `pip -v` to hide the user's password
Copy link Member cjerdonek Mar 1, 2019 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Since the URL isn't being removed but only the password, it would be better to say something like, "Redact the password from the extra index URL when using `pip -v`." Also, you want to use double backticks before and after "pip -v" rather than single, and end the sentence with a period. Copy link Contributor Author expobrain Mar 1, 2019 • edited Loading Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Do you mean like ``pip -v``? Copy link Member cjerdonek Mar 1, 2019 • edited Loading Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Yeah. I couldn't get it to render in GitHub's viewer when I first tried. The reason for double is because the contents are reStructuredText and not, say, Markdown: https://pip.pypa.io/en/stable/development/contributing/#contents-of-a-news-entry Copy link Contributor Author expobrain Mar 1, 2019 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. I used a backslash before the backtick to escape it and let Markdown ignore it