fix: strip credentials from url on merge message

Author: alex-titarenko

src/commands/fetch.ts

@@ -1,38 +1,38 @@
-import { Buffer } from 'buffer'
+import {
+  AuthCallback,
+  AuthFailureCallback,
+  AuthSuccessCallback,
+  HttpClient,
+  HttpHeaders,
+  MessageCallback,
+  ProgressCallback
+} from '../models'
 
-import { FileSystem } from '../models/FileSystem'
+import { Buffer } from 'buffer'
 import { Cache } from '../models/Cache'
-import { _currentBranch } from '../commands/currentBranch'
-import { MissingParameterError } from '../errors/MissingParameterError'
-import { RemoteCapabilityError } from '../errors/RemoteCapabilityError'
+import { FileSystem } from '../models/FileSystem'
+import { GitCommit } from '../models/GitCommit'
 import { GitConfigManager } from '../managers/GitConfigManager'
+import { GitPackIndex } from '../models/GitPackIndex'
 import { GitRefManager } from '../managers/GitRefManager'
 import { GitRemoteManager } from '../managers/GitRemoteManager'
 import { GitShallowManager } from '../managers/GitShallowManager'
-import { GitCommit } from '../models/GitCommit'
-import { GitPackIndex } from '../models/GitPackIndex'
-import { hasObject } from '../storage/hasObject'
-import { _readObject as readObject } from '../storage/readObject'
+import { MissingParameterError } from '../errors/MissingParameterError'
+import { RemoteCapabilityError } from '../errors/RemoteCapabilityError'
+import { _currentBranch } from '../commands/currentBranch'
 import { abbreviateRef } from '../utils/abbreviateRef'
 import { collect } from '../utils/collect'
 import { emptyPackfile } from '../utils/emptyPackfile'
 import { filterCapabilities } from '../utils/filterCapabilities'
-import { join } from '../utils/join'
+import { forAwait } from '../utils/forAwait'
 import { getGitClientAgent } from '../utils/pkg'
-import { splitLines } from '../utils/splitLines'
+import { hasObject } from '../storage/hasObject'
+import { join } from '../utils/join'
 import { parseUploadPackResponse } from '../wire/parseUploadPackResponse'
+import { _readObject as readObject } from '../storage/readObject'
+import { splitLines } from '../utils/splitLines'
+import { stripCredentialsFromUrl } from 'git-essentials/utils/url'
 import { writeUploadPackRequest } from '../wire/writeUploadPackRequest'
-import { forAwait } from '../utils/forAwait'
-import {
-  AuthCallback,
-  AuthFailureCallback,
-  AuthSuccessCallback,
-  HttpClient,
-  HttpHeaders,
-  MessageCallback,
-  ProgressCallback
-} from '../models'
-
 
 type FetchParams = {
   fs: FileSystem
@@ -346,7 +346,7 @@ export async function _fetch({
   const noun = fullref.startsWith('refs/tags') ? 'tag' : 'branch'
   const FETCH_HEAD = {
     oid,
-    description: `${noun} '${abbreviateRef(fullref)}' of ${url}`,
+    description: `${noun} '${abbreviateRef(fullref)}' of ${stripCredentialsFromUrl(url)}`,
   }
 
   if (onProgress || onMessage) {

src/utils/url.ts

@@ -0,0 +1,11 @@
+export function stripCredentialsFromUrl(urlString: string): string {
+  try {
+    const url = new URL(urlString);
+    url.username = '';
+    url.password = '';
+
+    return url.toString();
+  } catch {
+    return urlString;
+  }
+}

tests/fetch.test.ts

@@ -40,6 +40,29 @@ describe('fetch', () => {
     expect(await fs.exists(`${dir}/.git/refs/remotes/origin/main`)).toBe(false)
   })
 
+  it('strip credentials in git commit message', async () => {
+    // arrange
+    const { fs, dir } = await makeFsFixture(fetchEmptyRepoFsFixtureData as FsFixtureData)
+    const http = makeHttpFixture(fetchHttpFixtureData as HttpFixtureData)
+    const fetchUrl = 'http://username:password@localhost/fetch-server.git';
+    const fetchUrlWithoutCreds = 'http://localhost/fetch-server.git';
+
+    // act
+    const { fetchHeadDescription } = await fetch({
+      fs,
+      http,
+      url: fetchUrl,
+      dir,
+      singleBranch: true,
+      remote: 'origin',
+      ref: 'test'
+    })
+
+    // assert
+    expect(fetchHeadDescription).not.toContain(fetchUrl)
+    expect(fetchHeadDescription).toContain(fetchUrlWithoutCreds)
+  })
+
   it('shallow fetch', async () => {
     // arrange
     const { fs, dir } = await makeFsFixture(fetchEmptyRepoFsFixtureData as FsFixtureData)