Auto merge of #4704 - allenzhao:issue-4663, r=indirect

Filter out credentials in stderr message

This will close #4663
- [x] Fix broken tests

2 files changed, 23 insertions, 1 deletions

diff --git a/lib/bundler/source/git/git_proxy.rb b/lib/bundler/source/git/git_proxy.rb
index 693492f3d2..4b76d18735 100644
--- a/lib/bundler/source/git/git_proxy.rb
+++ b/lib/bundler/source/git/git_proxy.rb
@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require "tempfile"
 module Bundler
   class Source
     class Git < Path
@@ -156,7 +157,9 @@ module Bundler
           command_with_no_credentials = URICredentialsFilter.credential_filtered_string(command, uri)
           raise GitNotAllowedError.new(command_with_no_credentials) unless allow?
 
-          out = SharedHelpers.with_clean_git_env { `git #{command}` }
+          out = SharedHelpers.with_clean_git_env do
+            capture_and_filter_stderr(uri) { `git #{command}` }
+          end
 
           stdout_with_no_credentials = URICredentialsFilter.credential_filtered_string(out, uri)
           raise GitCommandError.new(command_with_no_credentials, path, error_msg) if check_errors && !$?.success?
@@ -220,6 +223,23 @@ module Bundler
           return in_path { yield } if allow?
           raise GitError, "The git source #{uri} is not yet checked out. Please run `bundle install` before trying to start your application"
         end
+
+        def capture_and_filter_stderr(uri)
+          return_value, captured_err = ""
+          backup_stderr = STDERR.dup
+          begin
+            Tempfile.open("captured_stderr") do |f|
+              STDERR.reopen(f)
+              return_value = yield
+              f.rewind
+              captured_err = f.read
+            end
+          ensure
+            STDERR.reopen backup_stderr
+          end
+          $stderr.puts URICredentialsFilter.credential_filtered_string(captured_err, uri) if uri && !captured_err.empty?
+          return_value
+        end
       end
     end
   end
diff --git a/spec/install/gemfile/git_spec.rb b/spec/install/gemfile/git_spec.rb
index bc9cc20870..f70ea5b43a 100644
--- a/spec/install/gemfile/git_spec.rb
+++ b/spec/install/gemfile/git_spec.rb
@@ -1136,6 +1136,7 @@ describe "bundle install with git sources" do
 
         bundle :install
         expect(out).to_not include("password1")
+        expect(err).to_not include("password1")
         expect(out).to include("Fetching https://user1@github.com/company/private-repo")
       end
     end
@@ -1152,6 +1153,7 @@ describe "bundle install with git sources" do
 
         bundle :install
         expect(out).to_not include("oauth_token")
+        expect(err).to_not include("oauth_token")
         expect(out).to include("Fetching https://x-oauth-basic@github.com/company/private-repo")
       end
     end