Command's DEBUG reveals username/password from URL about gitpython HOT 3 OPEN

Thanks for reporting.

Could you also show the python code that triggers these? I have a suspicion.

In any case, there already is functionality to hide seemingly sensitive data, but it's based on knowing where the data is.
If these debug lines are caused by repo.git.free_command() this wouldn't be the case.

If in doubt, that debug message can probably just be removed or downgraded to trace.

from gitpython.

Our core code:

try:
    repo = Repo.init(clpath, initial_branch=brname)
    repo.git.add(all=True)
    repo.index.commit(commit_message)
    repo.create_remote('origin', url=repository_to)
    repo.git.push('-u', 'origin', f'HEAD:{brname}')
except GitCommandError as ex:
    errmsg = str(ex.stderr)
    errmsg = re.sub(r'(.*fatal: )(.*)\n', r'\2', errmsg).strip('\n').rstrip("'")
    logger.error(f"Exception from git: {errmsg}")

Mentioned clone call (from other place in our code) that hides credentials in DEBUG output:

cloned = Repo.clone_from(repository_from, clpath, branch=source_branch)

from gitpython.

Thanks a lot! It looks like the create_remote() call is indeed provided by GitPython, and that it should ideally run the same obfuscation function that is also used in clone().

Further, one should probably review the public API and find all URL parameters, and assure that these are obfuscated in the log.

from gitpython.