Do not display passwords with pull/push/incoming/outgoing

Passwords specified in the repository URL are now displayed as '***'
when accessing the remote repository.

mercurial/commands.py

@@ -1652,7 +1652,7 b' def incoming(ui, repo, source="default",'
     cmdutil.setremoteconfig(ui, opts)
 
     other = hg.repository(ui, source)
-    ui.status(_('comparing with %s\n') % source)
+    ui.status(_('comparing with %s\n') % util.hidepassword(source))
     if revs:
         revs = [other.lookup(rev) for rev in revs]
     incoming = repo.findincoming(other, heads=revs, force=opts["force"])
@@ -1962,7 +1962,7 b' def outgoing(ui, repo, dest=None, **opts'
         revs = [repo.lookup(rev) for rev in revs]
 
     other = hg.repository(ui, dest)
-    ui.status(_('comparing with %s\n') % dest)
+    ui.status(_('comparing with %s\n') % util.hidepassword(dest))
     o = repo.findoutgoing(other, force=opts['force'])
     if not o:
         ui.status(_("no changes found\n"))
@@ -2095,7 +2095,7 b' def pull(ui, repo, source="default", **o'
     cmdutil.setremoteconfig(ui, opts)
 
     other = hg.repository(ui, source)
-    ui.status(_('pulling from %s\n') % (source))
+    ui.status(_('pulling from %s\n') % util.hidepassword(source))
     if revs:
         try:
             revs = [other.lookup(rev) for rev in revs]
@@ -2142,7 +2142,7 b' def push(ui, repo, dest=None, **opts):'
     cmdutil.setremoteconfig(ui, opts)
 
     other = hg.repository(ui, dest)
-    ui.status('pushing to %s\n' % (dest))
+    ui.status('pushing to %s\n' % util.hidepassword(dest))
     if revs:
         revs = [repo.lookup(rev) for rev in revs]
     r = repo.push(other, opts['force'], revs=revs)

mercurial/util.py

@@ -15,6 +15,7 b' platform-specific details from the core.'
 from i18n import _
 import cStringIO, errno, getpass, popen2, re, shutil, sys, tempfile, strutil
 import os, stat, threading, time, calendar, ConfigParser, locale, glob, osutil
+import re, urlparse
 
 try:
     set = set
@@ -1698,3 +1699,33 b' def drop_scheme(scheme, path):'
 def uirepr(s):
     # Avoid double backslash in Windows path repr()
     return repr(s).replace('\\\\', '\\')
+
+def hidepassword(url):
+    '''replaces the password in the url string by three asterisks (***)
+    
+    >>> hidepassword('http://www.example.com/some/path#fragment')
+    'http://www.example.com/some/path#fragment'
+    >>> hidepassword('http://[e-mail]/some/path#fragment')
+    'http://[e-mail]/some/path#fragment'
+    >>> hidepassword('http://me:[e-mail]/path#frag')
+    'http://me:***@www.example.com/path#frag'
+    >>> hidepassword('http://me:complex:[e-mail]/path#frag')
+    'http://me:***@www.example.com/path#frag'
+    >>> hidepassword('/path/to/repo')
+    '/path/to/repo'
+    >>> hidepassword('relative/path/to/repo')
+    'relative/path/to/repo'
+    >>> hidepassword('c:\\\\path\\\\to\\\\repo')
+    'c:\\\\path\\\\to\\\\repo'
+    >>> hidepassword('c:/path/to/repo')
+    'c:/path/to/repo'
+    >>> hidepassword('bundle://path/to/bundle')
+    'bundle://path/to/bundle'
+    '''
+    url_parts = list(urlparse.urlparse(url))
+    host_with_pw_pattern = re.compile('^([^:]*):([^@]*)@(.*)$')
+    if host_with_pw_pattern.match(url_parts[1]):
+        url_parts[1] = re.sub(host_with_pw_pattern, r'\1:***@\3',
+            url_parts[1])
+    return urlparse.urlunparse(url_parts)
+

tests/test-doctest.py

@@ -7,3 +7,6 b' doctest.testmod(mercurial.changelog)'
 
 import mercurial.httprepo
 doctest.testmod(mercurial.httprepo)
+
+import mercurial.util
+doctest.testmod(mercurial.util)