Change raise_for_status message to hide password in URL

[Overv]

This PR fixes #5021 by replacing a password in the URL with asterisks.

Example:

import requests

r = requests.get("http://foo:secret@httpbin.org/status/401")
r.raise_for_status()

Output:

Traceback (most recent call last):
  File "5021.py", line 4, in <module>
    r.raise_for_status()
  File "***/python-requests/requests/requests/models.py", line 968, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: UNAUTHORIZED for url: http://foo:***@httpbin.org/status/401

[jackyzha0]

Is there anything we need to update in the documentation for this? Other than that, looks good! 👍

[barroca]

can you add unit test for this change?

[Overv]

@jackyzha0 @barroca I'll have time to get back to this next weekend.

[barroca]

@Overv I opened a similar PR for this that might help you to write a test #5244 let me know if you need help.

[Overv]

I've added a unit test.

[barroca]

💡 I'd rather assert e is equals with the string with pass obfuscated, and also add a test that there doesn't obfuscate things that wasn't suppose to, but I'm happy to approve it.

[Overv]

I've made the test more specific now. How would you implement a test that checks if other things are not obfuscated?

[barroca]

You can create a test like this:

    def test_status_raising_doesnt_hides_other_stuff(self, httpbin):
        host = urlparse(httpbin()).netloc

        r = requests.get('http://shouldntchange@' + host + '/status/404')
        with pytest.raises(requests.exceptions.HTTPError) as e:
            r.raise_for_status()

        host_without_port = host.split(':')[0]

        assert str(e.value) == '404 Client Error: NOT FOUND for url: http://shouldntchange@' + host_without_port + '/status/404'

This is just a validation that the match doesn't put wrong information if the password is not supplied

[Overv]

Adding that test actually made me find two bugs!

• The host in the exception message no longer included the port, which shouldn't happen.
• Asterisks were included even if there was no password specified.

Thanks for the suggestion.

[mpolena]

Running into this same issue for requests with client_id and client_secret parameters in the url. Those values would get exposed despite the proposed fix here. Seems like a more general solution is needed.

[ZenithClown]

Running into this same issue for requests with access_key and apikey which exposes the API key.