Redact URL to hide password

src/pip/_internal/index.py

@@ -155,7 +155,7 @@ def _get_html_response(url, session):
     if _is_url_like_archive(url):
         _ensure_html_response(url, session=session)
 
-    logger.debug('Getting page %s', url)
+    logger.debug('Getting page %s', redact_password_from_url(url))
 
     resp = session.get(
         url,

tests/unit/test_index_html_page.py

@@ -118,6 +118,34 @@ def test_get_html_response_no_head(url):
     ]
 
 
+def test_get_html_response_dont_log_clear_text_password(caplog):
+    """
+    `_get_html_response()` shouldn't send a HEAD request if the URL does not
+    look like an archive, only the GET request that retrieves data.
+    """
+    password = "my_password"
+    url_template = "https://user:{}@example.com/simple/"
+    session = mock.Mock(PipSession)
+
+    # Mock the headers dict to ensure it is accessed.
+    session.get.return_value = mock.Mock(headers=mock.Mock(**{
+        "get.return_value": "text/html",
+    }))
+
+    caplog.set_level(logging.DEBUG)
+
+    resp = _get_html_response(url_template.format(password), session=session)
+
+    assert resp is not None
+
+    assert len(caplog.records) == 1
+    record = caplog.records[0]
+    assert record.levelname == 'DEBUG'
+    assert record.message.splitlines() == [
+        "Getting page {}".format(url_template.format("****")),
+    ]
+
+
 @pytest.mark.parametrize(
     "url, vcs_scheme",
     [