Remove username and password in remote url for cache directory name

CHANGELOG.mkd

@@ -6,6 +6,7 @@ Unreleased
 - Add `authorization_token` setting to allow authentication to a custom Forge server. [#1181](https://github.com/puppetlabs/r10k/pull/1181)
 - (RK-135) Attempting to download the latest version for a module that has no Forge releases will now issue a meaningful error. [#1177](https://github.com/puppetlabs/r10k/pull/1177)
 - Added an interface to R10K::Source::Base named `reload!` for updating the environments list for a given deployment; `reload!` is called before deployment purges to make r10k deploy pools more threadsafe. [#1172](https://github.com/puppetlabs/r10k/pull/1172)
+- Remove username and password from remote url in cache directory name [#1186](https://github.com/puppetlabs/r10k/pull/1186)
 ----------
 
 3.9.3

lib/r10k/git/cache.rb

@@ -111,6 +111,6 @@ def reset!
 
   # Reformat the remote name into something that can be used as a directory
   def sanitized_dirname
-    @sanitized_dirname ||= @remote.gsub(/[^@\w\.-]/, '-')
+    @sanitized_dirname ||= @remote.gsub(/(\w+:\/\/)(.*)(@)/, '\1').gsub(/[^@\w\.-]/, '-')
   end
 end

spec/unit/git/cache_spec.rb

@@ -62,4 +62,18 @@ def expect_delegation(method)
       subject.cached?
     end
   end
+
+  describe "dirname sanitization" do
+    it 'sanitizes cache directory name' do
+      expect(subject.sanitized_dirname).to eq('git---some-git-remote')
+    end
+
+    context 'with username and password' do
+      subject { subclass.new('https://"user:pa$$w0rd:@some/git/remote') }
+
+      it 'sanitizes cache directory name' do
+        expect(subject.sanitized_dirname).to eq('https---some-git-remote')
+      end
+    end
+  end
 end