Repository: pypa/setuptools

Issue:
Bugfix #1666 break access to index urls that include auth
The fix for issue #1666 breaks with urls that include a username and password. Here's an illustration of how it breaks:
```
$ easy_install -i https://user:password@pypi.example.org/simple/install example
Searching for example
Reading https://user:password@pypi.example.org/simple/install/example/
Download error on https://user:password@pypi.example.org/simple/install/example/: nonnumeric port: 'password@pypi.example.org' -- Some packages may not be found!
```

Bugfix #1666 break access to index urls that include auth
The fix for issue #1666 breaks with urls that include a username and password. Here's an illustration of how it breaks:
```
$ easy_install -i https://user:password@pypi.example.org/simple/install example
Searching for example
Reading https://user:password@pypi.example.org/simple/install/example/
Download error on https://user:password@pypi.example.org/simple/install/example/: nonnumeric port: 'password@pypi.example.org' -- Some packages may not be found!
```



Discussion:
Was this intentional @jaraco? I got the general sense that some support was maybe being dropped in those original PRs, but I don't think it was marked as a breaking change, right?

In any case, @tjarls, does this happen only when you invoke via `easy_install`? Can you solve your issue by using `pip` directly? This entire pathway is deprecated and is largely being maintained to "best effort" standards. I think it's definitely a bug if it's breaking backwards compatibility, but it would be good to get a sense of where to prioritize it.
It was not intentional.
Was this intentional @jaraco? I got the general sense that some support was maybe being dropped in those original PRs, but I don't think it was marked as a breaking change, right?

In any case, @tjarls, does this happen only when you invoke via `easy_install`? Can you solve your issue by using `pip` directly? This entire pathway is deprecated and is largely being maintained to "best effort" standards. I think it's definitely a bug if it's breaking backwards compatibility, but it would be good to get a sense of where to prioritize it.
It was not intentional.

Resolving patch:
diff --git a/setuptools/package_index.py b/setuptools/package_index.py
--- a/setuptools/package_index.py
+++ b/setuptools/package_index.py
@@ -850,16 +850,13 @@ def _download_html(self, url, headers, filename):
 
     def _download_svn(self, url, filename):
         warnings.warn("SVN download support is deprecated", UserWarning)
-        def splituser(host):
-            user, delim, host = host.rpartition('@')
-            return user, host
         url = url.split('#', 1)[0]  # remove any fragment for svn's sake
         creds = ''
         if url.lower().startswith('svn:') and '@' in url:
             scheme, netloc, path, p, q, f = urllib.parse.urlparse(url)
             if not netloc and path.startswith('//') and '/' in path[2:]:
                 netloc, path = path[2:].split('/', 1)
-                auth, host = splituser(netloc)
+                auth, host = _splituser(netloc)
                 if auth:
                     if ':' in auth:
                         user, pw = auth.split(':', 1)
@@ -1058,8 +1055,8 @@ def open_with_auth(url, opener=urllib.request.urlopen):
     if netloc.endswith(':'):
         raise http_client.InvalidURL("nonnumeric port: ''")
 
-    if scheme in ('http', 'https') and parsed.username:
-        auth = ':'.join((parsed.username, parsed.password))
+    if scheme in ('http', 'https'):
+        auth, address = _splituser(netloc)
     else:
         auth = None
 
@@ -1072,7 +1069,7 @@ def open_with_auth(url, opener=urllib.request.urlopen):
 
     if auth:
         auth = "Basic " + _encode_auth(auth)
-        parts = scheme, netloc, path, params, query, frag
+        parts = scheme, address, path, params, query, frag
         new_url = urllib.parse.urlunparse(parts)
         request = urllib.request.Request(new_url)
         request.add_header("Authorization", auth)
@@ -1086,13 +1083,20 @@ def open_with_auth(url, opener=urllib.request.urlopen):
         # Put authentication info back into request URL if same host,
         # so that links found on the page will work
         s2, h2, path2, param2, query2, frag2 = urllib.parse.urlparse(fp.url)
-        if s2 == scheme and h2 == parsed.hostname:
+        if s2 == scheme and h2 == address:
             parts = s2, netloc, path2, param2, query2, frag2
             fp.url = urllib.parse.urlunparse(parts)
 
     return fp
 
 
+# copy of urllib.parse._splituser from Python 3.8
+def _splituser(host):
+    """splituser('user[:passwd]@host[:port]') --> 'user[:passwd]', 'host[:port]'."""
+    user, delim, host = host.rpartition('@')
+    return (user if delim else None), host
+
+
 # adding a timeout to avoid freezing package_index
 open_with_auth = socket_timeout(_SOCKET_TIMEOUT)(open_with_auth)
 


Test patch: