clone/fetch: anonymize URLs in the reflog
Even if we strongly discourage putting credentials into the URLs passed via the command-line, there _is_ support for that, and users _do_ do that. Let's scrub them before writing them to the reflog. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Johannes Schindelin committed
Jun 4, 2020 at 20:08 UTC
46da295a77066994a663a47dc044f6c6fe582d26
3 files changed
+30
-7
builtin/clone.c
+8
-5
@@ -939,7 +939,7 @@ int cmd_clone(int argc, const char **argv, const char *prefix)
939
{
940
int is_bundle = 0, is_local;
941
const char *repo_name, *repo, *work_tree, *git_dir;
942
- char *path, *dir;
942
+ char *path, *dir, *display_repo = NULL;
943
int dest_exists;
944
const struct ref *refs, *remote_head;
945
const struct ref *remote_head_points_at;
@@ -994,10 +994,11 @@ int cmd_clone(int argc, const char **argv, const char *prefix)
994
path = get_repo_path(repo_name, &is_bundle);
995
if (path)
996
repo = absolute_pathdup(repo_name);
997
- else if (!strchr(repo_name, ':'))
998
- die(_("repository '%s' does not exist"), repo_name);
999
- else
997
+ else if (strchr(repo_name, ':')) {
998
repo = repo_name;
999
+ display_repo = transport_anonymize_url(repo);
1000
+ } else
1001
+ die(_("repository '%s' does not exist"), repo_name);
1002
1003
/* no need to be strict, transport_set_option() will validate it again */
1004
if (option_depth && atoi(option_depth) < 1)
@@ -1014,7 +1015,9 @@ int cmd_clone(int argc, const char **argv, const char *prefix)
1015
die(_("destination path '%s' already exists and is not "
1016
"an empty directory."), dir);
1017
1017
- strbuf_addf(&reflog_msg, "clone: from %s", repo);
1018
+ strbuf_addf(&reflog_msg, "clone: from %s",
1019
+ display_repo ? display_repo : repo);
1020
+ free(display_repo);
1021
1022
if (option_bare)
1023
work_tree = NULL;
builtin/fetch.c
+7
-2
@@ -1765,8 +1765,13 @@ int cmd_fetch(int argc, const char **argv, const char *prefix)
1765
1766
/* Record the command line for the reflog */
1767
strbuf_addstr(&default_rla, "fetch");
1768
- for (i = 1; i < argc; i++)
1769
- strbuf_addf(&default_rla, " %s", argv[i]);
1768
+ for (i = 1; i < argc; i++) {
1769
+ /* This handles non-URLs gracefully */
1770
+ char *anon = transport_anonymize_url(argv[i]);
1771
+
1772
+ strbuf_addf(&default_rla, " %s", anon);
1773
+ free(anon);
1774
+ }
1775
1776
fetch_config_from_gitmodules(&submodule_fetch_jobs_config,
1777
&recurse_submodules);
t/t5541-http-push-smart.sh
+15
@@ -456,6 +456,21 @@ test_expect_success 'push status output scrubs password' '
456
grep "^To $HTTPD_URL/smart/test_repo.git" status
457
'
458
459
+test_expect_success 'clone/fetch scrubs password from reflogs' '
460
+ cd "$ROOT_PATH" &&
461
+ git clone "$HTTPD_URL_USER_PASS/smart/test_repo.git" \
462
+ reflog-test &&
463
+ cd reflog-test &&
464
+ test_commit prepare-for-force-fetch &&
465
+ git switch -c away &&
466
+ git fetch "$HTTPD_URL_USER_PASS/smart/test_repo.git" \
467
+ +master:master &&
468
+ # should have been scrubbed down to vanilla URL
469
+ git log -g master >reflog &&
470
+ grep "$HTTPD_URL" reflog &&
471
+ ! grep "$HTTPD_URL_USER_PASS" reflog
472
+'
473
+
474
test_expect_success 'colorize errors/hints' '
475
cd "$ROOT_PATH"/test_repo_clone &&
476
test_must_fail git -c color.transport=always -c color.advice=always \