Fix leaked URLs with credentials in the output

[atugushev]

Fixes #1137.
Refs #811 and #1028.

Changelog-friendly one-liner: Fix leaked URLs with credentials in pip-compile's output.

Contributor checklist

• Provided the tests for the changes.
• Gave a clear one-line description in the PR (that the maintainers can add to CHANGELOG.md on release).
• Assign the PR to an existing or new milestone for the target version (following Semantic Versioning).

[codecov]

Codecov Report

Merging #1146 into master will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master    #1146   +/-   ##
=======================================
  Coverage   99.48%   99.49%           
=======================================
  Files          36       36           
  Lines        2736     2752   +16     
  Branches      324      326    +2     
=======================================
+ Hits         2722     2738   +16     
  Misses          8        8           
  Partials        6        6           

Impacted Files	Coverage Δ
tests/test_utils.py	100.00% <ø> (ø)
piptools/exceptions.py	100.00% <100.00%> (ø)
piptools/scripts/compile.py	100.00% <100.00%> (ø)
piptools/utils.py	100.00% <100.00%> (ø)
tests/test_cli_compile.py	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5dd163a...02bfe85. Read the comment docs.

[AndydeCleyre]

Nice work! Approved 👍

If you think it's appropriate, I would suggest renaming default_index_url in compile.py to better reflect that it's not the real default URL (redacted and used only for the help string).

[atugushev]

@AndydeCleyre

If you think it's appropriate, I would suggest renaming default_index_url in compile.py to better reflect that it's not the real default URL (redacted and used only for the help string).

Yeah, naming is hard :) For example:

• display_index_url
• help_index_url
• redacted_default_index_url
• show_default_index_url
• pipconf_index_url

What's your suggestion?

I'm also tempted to move some logic to a function to not waste global scope:

def _get_pip_default(option_name):
    install_command = create_command("install")
    pip_defaults = install_command.parser.get_default_values()
    return getattr(pip_defaults, option_name)

...

@click.option(
    "-i",
    "--index-url",
    help="Change index URL (defaults to {})".format(
        redact_auth_from_url(
            _get_pip_default("index_url")
        )
    ),
    envvar="PIP_INDEX_URL",
)

What do you think?

[AndydeCleyre]

Moving that into the function looks good. Otherwise, I'd say redacted_default_index_url is the most straightforward choice.

[atugushev]

@AndydeCleyre

Addressed in 302d46b.

[atugushev]

Thanks @AndydeCleyre for reviewing this!