Repository: xbmc/xbmc
File: xbmc/filesystem/Directory.cpp (C++)

Code before:
  {
    CURL realURL = URIUtils::SubstitutePath(url);
    if (!pDirectory)
      return false;

    // check our cache for this path
    if (g_directoryCache.GetDirectory(realURL, items,
                                      (hints.flags & DIR_FLAG_READ_CACHE) == DIR_FLAG_READ_CACHE))
      items.SetURL(url);
    else
    {
      // need to clear the cache (in case the directory fetch fails)
      // and (re)fetch the folder
      if (!(hints.flags & DIR_FLAG_BYPASS_CACHE))
        g_directoryCache.ClearDirectory(realURL);

      pDirectory->SetFlags(hints.flags);
      items.SetURL(url);

      bool result = false;
      CURL authUrl = realURL;

      while (!result)
      {
        // don't change auth if it's set explicitly
        authUrl = URIUtils::AddCredentials(authUrl);
        result = pDirectory->GetDirectory(authUrl, items);

        if (!result)
        {
          // @TODO ProcessRequirements() can bring up the keyboard input dialog
          // filesystem must not depend on GUI
          if (CServiceBroker::GetAppMessenger()->IsProcessThread() &&
              pDirectory->ProcessRequirements())
          {
            authUrl.SetDomain("");
            authUrl.SetUserName("");
            authUrl.SetPassword("");
            continue;
          }

          CLog::Log(LOGERROR, "{} - Error getting {}", __FUNCTION__, url.GetRedacted());
          return false;
        }
      }

      // hide credentials if necessary
      if (CPasswordManager::GetInstance().IsURLSupported(realURL))
      {
        bool hide = false;
        // for explicitly credentials

Review comment (security):
If you want to save on copies then you should use `std::move`:
```suggestion
        authUrl = URIUtils::AddCredentials(std::move(authUrl));
```
There are a couple more locations below  where it would make sense.

Code after:
  {
    CURL realURL = URIUtils::SubstitutePath(url);
    if (!pDirectory)
      return false;

    // check our cache for this path
    if (g_directoryCache.GetDirectory(realURL, items,
                                      (hints.flags & DIR_FLAG_READ_CACHE) == DIR_FLAG_READ_CACHE))
      items.SetURL(url);
    else
    {
      // need to clear the cache (in case the directory fetch fails)
      // and (re)fetch the folder
      if (!(hints.flags & DIR_FLAG_BYPASS_CACHE))
        g_directoryCache.ClearDirectory(realURL);

      pDirectory->SetFlags(hints.flags);
      items.SetURL(url);

      bool result = false;
      CURL authUrl = realURL;

      while (!result)
      {
        // don't change auth if it's set explicitly
        authUrl = URIUtils::AddCredentials(std::move(authUrl));
        result = pDirectory->GetDirectory(authUrl, items);

        if (!result)
        {
          // @TODO ProcessRequirements() can bring up the keyboard input dialog
          // filesystem must not depend on GUI
          if (CServiceBroker::GetAppMessenger()->IsProcessThread() &&
              pDirectory->ProcessRequirements())
          {
            authUrl.SetDomain("");
            authUrl.SetUserName("");
            authUrl.SetPassword("");
            continue;
          }

          CLog::Log(LOGERROR, "{} - Error getting {}", __FUNCTION__, url.GetRedacted());
          return false;
        }
      }

      // hide credentials if necessary
      if (CPasswordManager::GetInstance().IsURLSupported(realURL))
      {
        bool hide = false;
        // for explicitly credentials