Repository: astral-sh/uv
File: crates/uv-redacted/src/lib.rs (Rust)

Code before:
        } else if url.password().is_some() {
            ("", Some("****"))
        } else {
            ("", None)
        };

        f.debug_struct("DisplaySafeUrl")
            .field("scheme", &url.scheme())
            .field("cannot_be_a_base", &url.cannot_be_a_base())
            .field("username", &username)
            .field("password", &password)
            .field("host", &url.host())
            .field("port", &url.port())
            .field("path", &url.path())
            .field("query", &url.query())
            .field("fragment", &url.fragment())
            .finish()
    }
}

impl From<Url> for DisplaySafeUrl {
    fn from(url: Url) -> Self {
        // NOTE: Assumption: `url` preserves `DisplaySafeUrl` invariants.
        Self(url)
    }
}

impl From<DisplaySafeUrl> for Url {
    fn from(url: DisplaySafeUrl) -> Self {
        url.0
    }
}

impl FromStr for DisplaySafeUrl {
    type Err = DisplaySafeUrlError;

    fn from_str(input: &str) -> Result<Self, Self::Err> {
        Self::parse(input)
    }
}

fn is_ssh_git_username(url: &Url) -> bool {
    matches!(url.scheme(), "ssh" | "git+ssh" | "git+https")
        && url.username() == "git"
        && url.password().is_none()
}

fn display_with_redacted_credentials(
    url: &Url,
    f: &mut std::fmt::Formatter<'_>,
) -> std::fmt::Result {

Review comment (performance):
Flagging: we end up assuming a preserved invariant here, since we don't call `DisplaySafeUrl::parse` to filter out valid-but-ambiguous URLs. I can think of a few different workarounds to this:

1. Remove the `From<...>` impl entirely. This will cause a decent amount of code churn, since we have `DisplaySafeUrl::from(...)` sprinkled across the codebase. Instead, everything would need to go through `DisplaySafeUrl::parse(url.as_str())` or similar, i.e. go through a re-parse. @zanieb points out (and I agree) that this might be a performance risk, since we probably parse/create a _lot_ of these URL objects over the lifetime of a uv run.
2. Switch to `TryFrom` here, and devolve the ambiguity check in `DisplaySafeUrl::parse` into an associated helper so that we can reuse it. This would still require some code churn, but probably not as much as removing the `From` impl with no replacement.

Beyond those two options, a third option is to do nothing at all and keep this exactly as it is -- the assumption will then be that we're careful to only call `DisplaySafeUrl::from` on `Url` objects that have already had their invariant checked. I *think* this is currently true, since the main place where `DisplaySafeUrl::from` seems to get used is with `request.url()`, where we presumably fed the request a URL that we already validated.

Code after:
        let url = &self.0;
        // For URLs that use the `git` convention (i.e., `ssh://git@github.com/...`), avoid masking the
        // username.
        let (username, password) = if is_ssh_git_username(url) {
            (url.username(), None)
        } else if url.username() != "" && url.password().is_some() {
            (url.username(), Some("****"))
        } else if url.username() != "" {
            ("****", None)
        } else if url.password().is_some() {
            ("", Some("****"))
        } else {
            ("", None)
        };

        f.debug_struct("DisplaySafeUrl")
            .field("scheme", &url.scheme())
            .field("cannot_be_a_base", &url.cannot_be_a_base())
            .field("username", &username)
            .field("password", &password)
            .field("host", &url.host())
            .field("port", &url.port())
            .field("path", &url.path())
            .field("query", &url.query())
            .field("fragment", &url.fragment())
            .finish()
    }
}

impl From<DisplaySafeUrl> for Url {
    fn from(url: DisplaySafeUrl) -> Self {
        url.0
    }
}

impl FromStr for DisplaySafeUrl {
    type Err = DisplaySafeUrlError;

    fn from_str(input: &str) -> Result<Self, Self::Err> {
        Self::parse(input)
    }
}

fn is_ssh_git_username(url: &Url) -> bool {
    matches!(url.scheme(), "ssh" | "git+ssh" | "git+https")
        && url.username() == "git"
        && url.password().is_none()
}

fn display_with_redacted_credentials(
    url: &Url,