fix(util): redact URL credentials without corrupting the host

remove_password_if_present() redacted credentials by substituting them
into url.netloc with str.replace(), which rewrites every occurrence
anywhere in the netloc -- including the host.

  https://git@github.com/user/repo.git
    -> https://*****@*****hub.com/user/repo.git

"git" is the most common Git username and a substring of "github.com",
so this hits the common case. An empty username or password makes it
worse: str.replace("", "*****") matches at every position, so

  https://:token@fakerepo.example.com/testrepo

comes back shredded into a URL roughly ten times longer, which is what
lands in GitCommandError messages when a fetch fails.

Rebuild the netloc from its userinfo instead, so only the credentials
are replaced. The existing test already covered the empty-password case
but only asserted the password is absent, which any mangling satisfies.

The function is the single redaction path used for logged command lines
and for exception messages (git/cmd.py, git/exc.py, git/repo/base.py),
so this fixes all of them at once.

Author: yunaremaia

git/util.py

@@ -658,10 +658,14 @@ def remove_password_if_present(cmdline: Sequence[str]) -> List[str]:
             if url.password is None and url.username is None:
                 continue
 
-            if url.password is not None:
-                url = url._replace(netloc=url.netloc.replace(url.password, "*****"))
-            if url.username is not None:
-                url = url._replace(netloc=url.netloc.replace(url.username, "*****"))
+            # Redact the userinfo as a whole rather than substituting the
+            # username/password into the netloc: a substring replace also hits
+            # the host ("git" in "github.com") and an empty username or password
+            # matches at every position.
+            _, at, hostinfo = url.netloc.rpartition("@")
+            if at:
+                redacted = "*****:*****" if url.password is not None else "*****"
+                url = url._replace(netloc=f"{redacted}@{hostinfo}")
             new_cmdline[index] = urlunsplit(url)
         except ValueError:
             # This is not a valid URL.

test/test_util.py

@@ -828,6 +828,19 @@ def test_remove_password_from_command_line(self):
         assert authorization not in " ".join(redacted_cmd_6)
         assert "http.extraHeader=Authorization: *****" in redacted_cmd_6
 
+    def test_remove_password_keeps_host_intact(self):
+        """Redaction must not touch the host, even when it contains the username."""
+        redacted = remove_password_if_present(["git", "clone", "https://git@github.com/user/repo.git"])
+        assert redacted == ["git", "clone", "https://*****@github.com/user/repo.git"]
+
+        redacted = remove_password_if_present(["git", "clone", "ssh://git@github.com/u/r.git"])
+        assert redacted == ["git", "clone", "ssh://*****@github.com/u/r.git"]
+
+    def test_remove_empty_password_keeps_host_intact(self):
+        """An empty password must not expand into every position of the netloc."""
+        redacted = remove_password_if_present(["git", "clone", "https://:@fakerepo.example.com/testrepo"])
+        assert redacted == ["git", "clone", "https://*****:*****@fakerepo.example.com/testrepo"]
+
 
 def test_mode_str_to_int_accepts_bytes():
     assert mode_str_to_int("100644") == 0o100644