Fix intersphinx leaking basic auth credentials in error and info messages

sphinx/ext/intersphinx/_load.py

@@ -401,15 +401,15 @@ def _fetch_inventory_url(
     except Exception as err:
         err.args = (
             'intersphinx inventory %r not fetchable due to %s: %s',
-            inv_location,
+            _get_safe_url(inv_location),
             err.__class__,
             str(err),
         )
         raise
 
     if inv_location != new_inv_location:
         msg = __('intersphinx inventory has moved: %s -> %s')
-        LOGGER.info(msg, inv_location, new_inv_location)
+        LOGGER.info(msg, _get_safe_url(inv_location), _get_safe_url(new_inv_location))
 
         if target_uri in {
             inv_location,

tests/test_ext_intersphinx/test_ext_intersphinx.py

@@ -666,6 +666,66 @@ def test_getsafeurl_unauthed() -> None:
     assert actual == expected
 
 
+@mock.patch('sphinx.ext.intersphinx._load.requests.get')
+def test_fetch_inventory_url_error_hides_credentials(get_request):
+    """Credentials should not appear in error messages on fetch failure."""
+    from sphinx.ext.intersphinx._load import _fetch_inventory_url
+
+    get_request.side_effect = ConnectionError('connection refused')
+    with pytest.raises(ConnectionError, match='connection refused'):
+        _fetch_inventory_url(
+            target_uri='https://hostname/',
+            inv_location='https://user:secret@hostname/' + INVENTORY_FILENAME,
+            config=_InvConfig(
+                intersphinx_cache_limit=5,
+                intersphinx_timeout=None,
+                tls_verify=False,
+                tls_cacerts=None,
+                user_agent='',
+            ),
+        )
+    # Also verify the rewritten error args don't contain the password
+    try:
+        _fetch_inventory_url(
+            target_uri='https://hostname/',
+            inv_location='https://user:secret@hostname/' + INVENTORY_FILENAME,
+            config=_InvConfig(
+                intersphinx_cache_limit=5,
+                intersphinx_timeout=None,
+                tls_verify=False,
+                tls_cacerts=None,
+                user_agent='',
+            ),
+        )
+    except ConnectionError as exc:
+        error_text = str(exc.args)
+        assert 'secret' not in error_text
+        assert 'user@hostname' in error_text
+
+
+@mock.patch('sphinx.ext.intersphinx._load.InventoryFile')
+@mock.patch('sphinx.ext.intersphinx._load.requests.get')
+@pytest.mark.sphinx('html', testroot='root')
+def test_fetch_inventory_redirect_hides_credentials(get_request, InventoryFile, app):
+    """Credentials should not appear in redirect log messages."""
+    mocked_get = get_request.return_value.__enter__.return_value
+    intersphinx_setup(app)
+    mocked_get.content = b'# Sphinx inventory version 2'
+
+    mocked_get.url = 'https://user:secret@hostname/new/' + INVENTORY_FILENAME
+
+    target_uri = 'https://hostname/'
+    _, target_uri = _fetch_inventory_data(
+        target_uri=target_uri,
+        inv_location='https://user:secret@hostname/' + INVENTORY_FILENAME,
+        config=_InvConfig.from_config(app.config),
+        srcdir=app.srcdir,
+        cache_path=None,
+    )
+    status_output = app.status.getvalue()
+    assert 'secret' not in status_output
+
+
 def test_inspect_main_noargs(capsys):
     """inspect_main interface, without arguments"""
     assert inspect_main([]) == 1