Auth not redacted in string representation of the requirement

Open
#416 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
35/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
python
Domain
security

Research direction

Start in packaging/requirements.py at the Requirement string representation around line 136, then review the linked pip issue for the reported credential exposure. Done means sensitive authentication data in a requirement URL is redacted from its string representation; verify the resulting representation does not reveal those credentials.

Written by the indexing model from the issue text.

Description

enhancement packaging.requirements

Hi there 😄

Inside the Requirement class, the url part of the requirement is added to the string repr without redacting any possible sensitive data.
https://github.com/pypa/packaging/blob/745bb0a763517a21422e74e936a24b043e8dc225/packaging/requirements.py#L136

In pip, there is an issue about this behaviour. Instead of fixing it in the vendored version of pip, we should fix probably fix it upstream instead.

Lemme know what you think 😃

Dominant language
Python
Stars
751
Forks
324
Avg merge
12h 58m
Merged PRs (30d)
3

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from pypa/packaging

All issues in pypa/packaging

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.