Redact index password from logs

Closes pypa#6124
xavfernandez · Jan 10, 2019 · 01224df · 01224df
1 parent 4771470
commit 01224df
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/news/6124.bugfix b/news/6124.bugfix
@@ -0,0 +1 @@
+Redact the password from index urls in a debug message (using --no-index & --verbose options together)
diff --git a/src/pip/_internal/cli/base_command.py b/src/pip/_internal/cli/base_command.py
@@ -27,7 +27,9 @@
 )
 from pip._internal.req.req_file import parse_requirements
 from pip._internal.utils.logging import setup_logging
-from pip._internal.utils.misc import get_prog, normalize_path
+from pip._internal.utils.misc import (
+    get_prog, normalize_path, redact_password_from_url,
+)
 from pip._internal.utils.outdated import pip_version_check
 from pip._internal.utils.typing import MYPY_CHECK_RUNNING
 
@@ -287,7 +289,10 @@ def _build_package_finder(
         """
         index_urls = [options.index_url] + options.extra_index_urls
         if options.no_index:
-            logger.debug('Ignoring indexes: %s', ','.join(index_urls))
+            logger.debug(
+                'Ignoring indexes: %s',
+                ','.join(redact_password_from_url(url) for url in index_urls),
+            )
             index_urls = []
 
         return PackageFinder(