Mask credentials from URL when import of project has failed.

1 files changed, 15 insertions, 2 deletions

diff --git a/lib/gitlab/import_url.rb b/lib/gitlab/url_sanitizer.rb
index d23b013c1f5..c59d53b941a 100644
--- a/lib/gitlab/import_url.rb
+++ b/lib/gitlab/url_sanitizer.rb
@@ -1,7 +1,13 @@
 module Gitlab
-  class ImportUrl
+  class UrlSanitizer
+    def self.sanitize(content)
+      regexp = URI::Parser.new.make_regexp(['http', 'https', 'ssh', 'git'])
+
+      content.gsub(regexp) { |url| new(url).masked_url }
+    end
+
     def initialize(url, credentials: nil)
-      @url = URI.parse(URI.encode(url))
+      @url = Addressable::URI.parse(URI.encode(url))
       @credentials = credentials
     end
 
@@ -9,6 +15,13 @@ module Gitlab
       @sanitized_url ||= safe_url.to_s
     end
 
+    def masked_url
+      url = @url.dup
+      url.password = "*****" unless url.password.nil?
+      url.user = "*****" unless url.user.nil?
+      url.to_s
+    end
+
     def credentials
       @credentials ||= { user: @url.user, password: @url.password }
     end