Repository navigation
Plaintext credential is exposed in CommandError if Authorization is passed in http.extraHeader #1626
Description
If credentials are passed in the URI, e.g. https://user:pass@foo.com/bar.git then the credential is properly removed from the cmdline in the exception, but if an authorization header is set via http.extraHeader then the credential is not stripped from the exception.
Activity
Byron commentedon Aug 4, 2023
I acknowledge this issue tentatively as the issue is related to security, but wish there would be steps that help to reproduce it as well.
A potential fix could use that to setup a test for reproduction, along with the fix.