sphinx-doc / sphinx-doc/sphinx

intersphinx exposes basic auth password if connection fails

Open
#14,342 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

extensions:intersphinx type:bug
Dominant language
Python
Stars
8k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

When using basic auth for inter-sphinx, sphinx will display the uncensored credentials if there is any error accessing the objects.inv file.

see https://github.com/jamesharris-garmin/intersphinx-bad-auth-example/blob/main/README.md for a complete description.

How to Reproduce

I have included a minimal reproducible case at this repository jamesharris-garmin/intersphinx-bad-auth-example

Environment Information
Platform:              linux; (Linux-6.8.0-101-generic-x86_64-with-glibc2.35)
Python version:        3.13.0 (main, Oct 16 2024, 03:23:02) [Clang 18.1.8 ])
Python implementation: CPython
Sphinx version:        9.1.0
Docutils version:      0.22.4
Jinja2 version:        3.1.6
Pygments version:      2.19.2
Sphinx extensions
'sphinx.ext.intersphinx'
Additional context

This is especially bad if the correct credentials are present in the URL but the URL is otherwise wrong causing additional issues.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure using the linked intersphinx-bad-auth-example and inspect the sphinx.ext.intersphinx error path used when accessing objects.inv. Trace how the authenticated URL is included in the failure output; done means connection errors no longer expose the basic-auth password while still reporting the access problem.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
documentation, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.