(incubator-devlake) branch release-v1.0 updated: fix(gitextractor): sanitize git tokens (#7767) (#7768)

[ly...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lynwee pushed a commit to branch release-v1.0
in repository https://gitbox.apache.org/repos/asf/incubator-devlake.git


The following commit(s) were added to refs/heads/release-v1.0 by this push:
     new 87f596549 fix(gitextractor): sanitize git tokens (#7767) (#7768)
87f596549 is described below

commit 87f59654997a68dfc0953b865fc94fa425a1afb8
Author: github-actions[bot] <41...@users.noreply.github.com>
AuthorDate: Fri Jul 19 17:42:13 2024 +0800

    fix(gitextractor): sanitize git tokens (#7767) (#7768)
    
    Co-authored-by: Lynwee <15...@qq.com>
---
 backend/plugins/gitextractor/parser/clone_gitcli.go | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/backend/plugins/gitextractor/parser/clone_gitcli.go b/backend/plugins/gitextractor/parser/clone_gitcli.go
index 184dc26ff..34e254016 100644
--- a/backend/plugins/gitextractor/parser/clone_gitcli.go
+++ b/backend/plugins/gitextractor/parser/clone_gitcli.go
@@ -231,7 +231,22 @@ func (g *GitcliCloner) execCommand(cmd *exec.Cmd) errors.Error {
 			strings.Contains(outputString, "fatal: the remote end hung up unexpectedly") {
 			return ErrNoData
 		}
-		return errors.Default.New(fmt.Sprintf("git cmd %v in %s failed: %s", cmd.Args, cmd.Dir, outputString))
+		return errors.Default.New(fmt.Sprintf("git cmd %v in %s failed: %s", sanitizeArgs(cmd.Args), cmd.Dir, outputString))
 	}
 	return nil
 }
+
+func sanitizeArgs(args []string) []string {
+	var ret []string
+	for _, arg := range args {
+		u, err := url.Parse(arg)
+		if err == nil && u != nil && u.User != nil {
+			password, ok := u.User.Password()
+			if ok {
+				arg = strings.Replace(arg, password, strings.Repeat("*", len(password)), -1)
+			}
+		}
+		ret = append(ret, arg)
+	}
+	return ret
+}