feat: use GIT_ASKPASS with git clone so tokens do not appear in log messages

Project.toml

@@ -1,7 +1,7 @@
 name = "Registrator"
 uuid = "4418983a-e44d-11e8-3aec-9789530b3b3e"
 authors = ["Stefan Karpinski <[email protected]>"]
-version = "1.9.3"
+version = "1.9.4"
 
 [deps]
 AutoHashEquals = "15f4f7f2-30c1-5605-9d31-71845cf9641f"

src/webui/gitutils.jl

@@ -244,7 +244,9 @@ function gettreesha(
         url = cloneurl(r)
         mktempdir() do dir
             dest = joinpath(dir, r.name)
-            run(`git clone --bare $url $dest`)
+            withpasswd(url) do url, env
+                run(Cmd(`git clone --bare $url $dest`; env))
+            end
             readchomp(`git -C $dest rev-parse $ref:$subdir`), ""
         end
     catch ex
@@ -253,6 +255,39 @@ function gettreesha(
     end
 end
 
+withpasswd(func, url::AbstractString) = withpasswd(func, URI(url))
+
+"""
+* Remove user and password from provided URL
+* Create a temporary command TMPCMD that Git can use that provides the user and password
+* run provided function with the resulting URL and an environment array with GIT_ASKPASS=TMPCMD
+"""
+function withpasswd(func, url::URI)
+    local info = url.userinfo
+    isempty(info) &&
+        return func(url, [])
+    local user, passwd = split(info, ":")
+    local newurl = URI(replace(string(url), "$info@" => ""))
+    mktemp() do path, io
+        print(io, """
+#!/bin/sh
+case "\$1" in
+    Username*)
+        echo "$user"
+        ;;
+    Password*)
+        echo "$passwd"
+        ;;
+esac
+""")
+        close(io)
+        chmod(path, 0o700)
+        func(newurl, [
+            "GIT_ASKPASS=$path"
+        ])
+    end
+end
+
 function ensure_already_exists(f::Function, resp::HTTP.Response, status::Int)
     resp.status == status || return false
     data = JSON.parse(String(copy(resp.body)))