push: anonymize URL in status output

Commit 47abd85 (fetch: Strip usernames from url's before
storing them, 2009-04-17) taught fetch to anonymize URLs.
The primary purpose there was to avoid sticking passwords in
merge-commit messages, but as a side effect, we also avoid
printing them to stderr.

The push side does not have the merge-commit problem, but it
probably should avoid printing them to stderr. We can reuse
the same anonymizing function.

Note that for this to come up, the credentials would have to
appear either on the command line or in a git config file,
neither of which is particularly secure. So people _should_
be switching to using credential helpers instead, which
makes this problem go away. But that's no excuse not to
improve the situation for people who for whatever reason end
up using credentials embedded in the URL.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/t/t5541-http-push-smart.sh b/t/t5541-http-push-smart.sh
index fd7d06b9a23664d0e20cc32a03955ff8816cac7f..8d08e0632719478766d705aa2625d50a2699ee23 100755 (executable)
--- a/t/t5541-http-push-smart.sh
+++ b/t/t5541-http-push-smart.sh
@@ -368,5 +368,12 @@ test_expect_success GPG 'push with post-receive to inspect certificate' '
        test_cmp expect "$HTTPD_DOCUMENT_ROOT_PATH/push-cert-status"
 '
 
+test_expect_success 'push status output scrubs password' '
+       test_commit scrub &&
+       git push --porcelain "$HTTPD_URL_USER_PASS/smart/test_repo.git" >status &&
+       # should have been scrubbed down to vanilla URL
+       grep "^To $HTTPD_URL/smart/test_repo.git" status
+'
+
 stop_httpd
 test_done

diff --git a/transport.c b/transport.c
index 198502d0ba8404ecf8d27acbd5f46639ac1934ae..ff1b516943fd4069b9be247a8ec348b51df1ba29 100644 (file)
--- a/transport.c
+++ b/transport.c
@@ -681,8 +681,11 @@ static void print_ok_ref_status(struct ref *ref, int porcelain)
 
 static int print_one_push_status(struct ref *ref, const char *dest, int count, int porcelain)
 {
-       if (!count)
-               fprintf(porcelain ? stdout : stderr, "To %s\n", dest);
+       if (!count) {
+               char *url = transport_anonymize_url(dest);
+               fprintf(porcelain ? stdout : stderr, "To %s\n", url);
+               free(url);
+       }
 
        switch(ref->status) {
        case REF_STATUS_NONE: