index-url password is displayed on pip install.

[Bolayniuss]

• Pip version: 10.0.0
• Python version: 2.7.14
• Operating system: macOS

Description:

When index-url is set (with either --index-url or --extra-index-url) with user credentials, the password is displayed each time pip is used. This is clearly a security issue, before pip 10 this was displayed only in verbose mode. The password should always be masked.

What I've run:

pip install private-package

[danieljacobs1]

Also happens if you have index-url set in ~/.pip/pip.conf.

[pradyunsg]

@pfmoore thoughts on this? This happened as a part of #4483.

I can whip up a PR to strip the username/password when printing the URIs as a quick fix; thoughts?

[pradyunsg]

Or make it conditional to verbosity.

[pradyunsg]

I think hiding this behind verbosity and deferring to #4746 for the actual hiding of passwords in that mode makes more sense.

Making a PR for this.

[pfmoore]

@pradyunsg Agreed

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.