From 04d7e2713466a06df6445fb0b01c3b9c79879ec7 Mon Sep 17 00:00:00 2001
From: scheel <scheel@adobe.com>
Date: Thu, 9 May 2024 08:51:54 -0600
Subject: [PATCH] Sanitize URLs for logging/display purposes.

---
 twine/commands/upload.py | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/twine/commands/upload.py b/twine/commands/upload.py
index 5d099b3f..85833111 100644
--- a/twine/commands/upload.py
+++ b/twine/commands/upload.py
@@ -17,6 +17,7 @@
 import fnmatch
 import logging
 import os.path
+import re
 from typing import Dict, List, NamedTuple, cast
 
 import requests
@@ -148,6 +149,26 @@ def _split_inputs(
     return Inputs(dists, signatures, attestations_by_dist)
 
 
+def _sanitize_url(url) -> str:
+    """
+    Sanitize URLs, removing any user:password combinations and replacing them with
+    asterisks.  Returns the original URL if the string is a non-matching pattern.
+
+    :param url:
+        str containing a URL to sanitize.
+
+    return:
+        str either sanitized or as entered depending on pattern match.
+    """
+    pattern = "(.*https?://)(\w+:\w+)@(\w+\..*)"
+    m = re.match(pattern, url)
+    if m:
+        newurl = f"{m.group(1)}*****:*****@{m.group(3)}"
+        return newurl
+    else:
+        return url
+
+
 def upload(upload_settings: settings.Settings, dists: List[str]) -> None:
     """Upload one or more distributions to a repository, and display the progress.
 
@@ -189,7 +210,7 @@ def upload(upload_settings: settings.Settings, dists: List[str]) -> None:
     # Determine if the user has passed in pre-signed distributions or any attestations.
     uploads, signatures, attestations_by_dist = _split_inputs(dists)
 
-    print(f"Uploading distributions to {repository_url}")
+    print(f"Uploading distributions to {_sanitize_url(repository_url)}")
 
     packages_to_upload = [
         _make_package(