chore: strip any basic auth information before matching

Signed-off-by: Jennifer Power <[email protected]>
RedHatProductSecurity · Aug 12, 2023 · acc6840 · acc6840
1 parent 41dfeea
commit acc6840
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/tests/trestlebot/test_gitlab.py b/tests/trestlebot/test_gitlab.py
@@ -33,6 +33,7 @@
     [
         "https://gitlab.com/owner/repo",
         "https://gitlab.com/owner/repo.git",
+        "https://test:[email protected]/owner/repo.git",
         "gitlab.com/owner/repo.git",
     ],
 )

diff --git a/trestlebot/gitlab.py b/trestlebot/gitlab.py
@@ -47,10 +47,13 @@ def parse_repository(self, repo_url: str) -> Tuple[str, str]:
             Owner and project name in a tuple, respectively
         """
 
-        match = re.match(self.pattern, repo_url)
+        # Strip out any basic auth
+        stripped_url = re.sub(r"https?://.*?@", "https://", repo_url)
+
+        match = re.match(self.pattern, stripped_url)
 
         if not match:
-            raise GitProviderException(f"{repo_url} is an invalid repo URL")
+            raise GitProviderException(f"{stripped_url} is an invalid repo URL")
 
         owner = match.group(1)[1:]  # Removing the leading slash
         repo = match.group(2)