Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3dd07fee85869b16f635ec53e3ff6f23d88e5941
https://github.com/WebKit/WebKit/commit/3dd07fee85869b16f635ec53e3ff6f23d88e5941
Author: Issac Roy <[email protected]>
Date: 2026-06-25 (Thu, 25 Jun 2026)
Changed paths:
M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/__init__.py
M
Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/pull_request_unittest.py
Log Message:
-----------
`git-webkit pr` may leak username/password as plain text in stdout if certain
Bugzilla requests time out
rdar://180346543
https://bugs.webkit.org/show_bug.cgi?id=317765
Reviewed by Sam Sneddon and Elliott Williams.
Fixed by wrapping the top-level `parsed.main()` call in a try/except that
catches all unhandled exceptions, scrubs `login=` and `password=` query
parameters from the full traceback string via regex, and prints the
sanitized traceback to `stderr`.
* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/__init__.py:
Wrap `parsed.main()` in a try/except, redacting credentials from the
traceback before printing to stderr.
* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/pull_request_unittest.py:
(TestDoPullRequest.test_redacts_credentials_in_traceback): Added.
Canonical link: https://commits.webkit.org/315864@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
