sphinx-doc / sphinx-doc/sphinx
intersphinx exposes basic auth password if connection fails
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
When using basic auth for inter-sphinx, sphinx will display the uncensored credentials if there is any error accessing the objects.inv file.
see https://github.com/jamesharris-garmin/intersphinx-bad-auth-example/blob/main/README.md for a complete description.
How to Reproduce
I have included a minimal reproducible case at this repository jamesharris-garmin/intersphinx-bad-auth-example
Environment Information
Platform: linux; (Linux-6.8.0-101-generic-x86_64-with-glibc2.35)
Python version: 3.13.0 (main, Oct 16 2024, 03:23:02) [Clang 18.1.8 ])
Python implementation: CPython
Sphinx version: 9.1.0
Docutils version: 0.22.4
Jinja2 version: 3.1.6
Pygments version: 2.19.2
Sphinx extensions
'sphinx.ext.intersphinx'
Additional context
This is especially bad if the correct credentials are present in the URL but the URL is otherwise wrong causing additional issues.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure using the linked intersphinx-bad-auth-example and inspect the sphinx.ext.intersphinx error path used when accessing objects.inv. Trace how the authenticated URL is included in the failure output; done means connection errors no longer expose the basic-auth password while still reporting the access problem.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- documentation, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100