Don't expose URL credentials in errors generated by Mirror sync.

With this fix we remove the credentials from the repo URLs that are shown when
there is an internal error with Git

app/models/project.rb

@@ -571,7 +571,7 @@ class Project < ActiveRecord::Base
 
   def mark_import_as_failed(error_message)
     import_fail
-    update_column(:import_error, error_message)
+    update_column(:import_error, Gitlab::UrlCredentialsFilter.process(error_message))
   end
 
   def has_remote_mirror?

app/models/remote_mirror.rb

@@ -95,7 +95,7 @@ class RemoteMirror < ActiveRecord::Base
 
   def mark_as_failed(error_message)
     update_fail
-    update_column(:last_error, error_message)
+    update_column(:last_error, Gitlab::UrlCredentialsFilter.process(error_message))
   end
 
   def url=(value)

lib/gitlab/url_credentials_filter.rb

+module Gitlab
+  class UrlCredentialsFilter
+    def self.process(content)
+      regexp = URI::Parser.new.make_regexp(['http', 'https', 'ssh', 'git'])
+
+      content.gsub(regexp) { |url| Gitlab::ImportUrl.new(url).sanitized_url }
+    end
+  end
+end

spec/lib/gitlab/url_credentials_filter_spec.rb

+require 'spec_helper'
+
+describe Gitlab::UrlCredentialsFilter, lib: true do
+  let(:filtered_content) do
+    described_class.process(%Q{remote: Not Found
+       fatal: repository 'http://user:pass@test.com/root/repoC.git/' not found
+       remote: Not Found
+       fatal: repository 'https://user:pass@test.com/root/repoA.git/' not found
+       remote: Not Found
+       ssh://user@host.test/path/to/repo.git
+       remote: Not Found
+       git://host.test/path/to/repo.git
+    })
+  end
+
+  it 'remove credentials from HTTP URLs' do
+    expect(filtered_content).to include("http://test.com/root/repoC.git/")
+  end
+
+  it 'remove credentials from HTTPS URLs' do
+    expect(filtered_content).to include("https://test.com/root/repoA.git/")
+  end
+
+  it 'remove credentials from SSH URLs' do
+    expect(filtered_content).to include("ssh://host.test/path/to/repo.git")
+  end
+
+  it 'does not modify Git URLs' do
+    # git protocol does not support authentication
+    expect(filtered_content).to include("git://host.test/path/to/repo.git")
+  end
+end