Fix intersphinx leaking basic auth credentials in error and info messages

sphinx/ext/intersphinx/_load.py

@@ -399,17 +399,18 @@ def _fetch_inventory_url(
             raw_data = r.content
             new_inv_location = r.url
     except Exception as err:
+        safe_url = _get_safe_url(inv_location)
         err.args = (
             'intersphinx inventory %r not fetchable due to %s: %s',
-            inv_location,
+            safe_url,
             err.__class__,
-            str(err),
+            str(err).replace(inv_location, safe_url),
         )
         raise
 
     if inv_location != new_inv_location:
         msg = __('intersphinx inventory has moved: %s -> %s')
-        LOGGER.info(msg, inv_location, new_inv_location)
+        LOGGER.info(msg, _get_safe_url(inv_location), _get_safe_url(new_inv_location))
 
         if target_uri in {
             inv_location,

tests/test_ext_intersphinx/test_ext_intersphinx.py

@@ -666,6 +666,49 @@ def test_getsafeurl_unauthed() -> None:
     assert actual == expected
 
 
+def test_fetch_inventory_url_error_hides_credentials(capsys):
+    """Credentials should not appear in error messages on fetch failure."""
+
+    class ErrorHandler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):
+            self.send_error(500, 'Internal Server Error')
+
+        def log_message(*args, **kwargs):
+            pass
+
+    with http_server(ErrorHandler) as server:
+        url = f'http://user:secret@localhost:{server.server_port}/{INVENTORY_FILENAME}'
+        inspect_main([url])
+
+    _, stderr = capsys.readouterr()
+    assert 'secret' not in stderr
+    assert 'user@localhost' in stderr
+
+
+@mock.patch('sphinx.ext.intersphinx._load.InventoryFile')
+@mock.patch('sphinx.ext.intersphinx._load.requests.get')
+@pytest.mark.sphinx('html', testroot='root')
+def test_fetch_inventory_redirect_hides_credentials(get_request, InventoryFile, app):
+    """Credentials should not appear in redirect log messages."""
+    mocked_get = get_request.return_value.__enter__.return_value
+    intersphinx_setup(app)
+    mocked_get.content = b'# Sphinx inventory version 2'
+
+    mocked_get.url = 'https://user:secret@hostname/new/' + INVENTORY_FILENAME
+
+    target_uri = 'https://hostname/'
+    _, target_uri = _fetch_inventory_data(
+        target_uri=target_uri,
+        inv_location='https://user:secret@hostname/' + INVENTORY_FILENAME,
+        config=_InvConfig.from_config(app.config),
+        srcdir=app.srcdir,
+        cache_path=None,
+    )
+    status_output = app.status.getvalue()
+    assert 'secret' not in status_output
+    assert 'user@hostname' in status_output
+
+
 def test_inspect_main_noargs(capsys):
     """inspect_main interface, without arguments"""
     assert inspect_main([]) == 1