From bdc9678e2211cebf843a6f470397d50077f7705f Mon Sep 17 00:00:00 2001
From: Henry <14799603+henryas@users.noreply.github.com>
Date: Sun, 4 Jul 2021 22:35:23 +0700
Subject: [PATCH] possible fix for #910 (#911)

* fix #910

* Update src/nimblepkg/publish.nim

Co-authored-by: Andreas Rumpf <rumpf_a@web.de>

* update detection algorithm

* quit if url is insecure

* raise exception instead of quit

* Update src/nimblepkg/publish.nim

Co-authored-by: Andreas Rumpf <rumpf_a@web.de>
Co-authored-by: Dominik Picheta <dominikpicheta@googlemail.com>
---
 src/nimblepkg/publish.nim | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/nimblepkg/publish.nim b/src/nimblepkg/publish.nim
index 7e591562..eb4395cd 100644
--- a/src/nimblepkg/publish.nim
+++ b/src/nimblepkg/publish.nim
@@ -205,10 +205,17 @@ proc publish*(p: PackageInfo, o: Options) =
       if url.endsWith(".git"): url.setLen(url.len - 4)
       downloadMethod = "git"
     let parsed = parseUri(url)
+
     if parsed.scheme == "":
       # Assuming that we got an ssh write/read URL.
       let sshUrl = parseUri("ssh://" & url)
       url = "https://" & sshUrl.hostname & "/" & sshUrl.port & sshUrl.path
+    elif parsed.username != "" or parsed.password != "":
+      # check for any confidential information
+      # TODO: Use raiseNimbleError(msg, hintMsg) here
+      raise newException(NimbleError,
+        "Cannot publish the repository URL because it contains username and/or password. Fix the remote URL. Hint: \"git remote -v\"")
+
   elif dirExists(os.getCurrentDir() / ".hg"):
     downloadMethod = "hg"
     # TODO: Retrieve URL from hg.