Pip does not redact passwords when collecting git dependencies

[tmr232]

pip version

21.0.1

Python version

3.7

OS

Windows 10, Ubuntu 18

Additional information

No response

Description

When installing a package with git-based dependencies with credentials, the password is displayed when printing the "Collecting" message. The rest is ok.

Expected behavior

The password in the URL is always redacted.

How to Reproduce

1. Create a setup.py file containing the following:

from setuptools import setup

setup(
    install_requires="dependency @ git+https://user:secret-token@example.com",
)

2. Run pip install .
3. You can see the unredacted password ("secret-token") in the messages printed to the console.

Output

$ pip install .
Defaulting to user installation because normal site-packages is not writeable
Processing /path/to/package
Collecting dependency@ git+https://user:secret-token@example.com
  Cloning https://user:****@example.com to /tmp/pip-install-ighmw36e/dependency

Code of Conduct

• I agree to follow the PSF Code of Conduct

[uranusjr]

I’m hesitant to call this a bug since if you are willing to hard-code the credentials in a setup.py (which is designed for public consumption). you should probably accept it not being secret. It’s philosophically different from credentials passed in from e.g. environment variables.

[tmr232]

The results are the same when I get the token from environment variables. I used a hardcoded version here as it requires no setup to reproduce.

In the real use-case I have code reading environment variables to generate the dependency string, but what is passed into the call to setup() is still the same.

[pradyunsg]

The results are the same when I get the token from environment variables.

Are you reading them in the setup.py file? Or somewhere else?

[pradyunsg]

In the real use-case I have code reading environment variables to generate the dependency string, but what is passed into the call to setup() is still the same.

Ah, I missed this. It's probably worth fixing, so PRs are welcome.

I'm personally not inclined to look into this, so I won't be doing anything to address this.