From 4f89a2407a8bbd0de11fbc05515d50e80c14a5f5 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Thu, 9 Apr 2026 15:04:37 +0200
Subject: [PATCH] gitutil: use BuildKit urlutil.RedactCredentials for remote
 URLs

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 util/gitutil/credentials_test.go              | 44 -------------------
 util/gitutil/gitutil.go                       | 21 ++-------
 .../moby/buildkit/util/urlutil/redact.go      | 33 ++++++++++++++
 vendor/modules.txt                            |  1 +
 4 files changed, 38 insertions(+), 61 deletions(-)
 delete mode 100644 util/gitutil/credentials_test.go
 create mode 100644 vendor/github.com/moby/buildkit/util/urlutil/redact.go

diff --git a/util/gitutil/credentials_test.go b/util/gitutil/credentials_test.go
deleted file mode 100644
index 7225f8dc1..000000000
--- a/util/gitutil/credentials_test.go
+++ /dev/null
@@ -1,44 +0,0 @@
-package gitutil
-
-import "testing"
-
-func TestStripCredentials(t *testing.T) {
-	cases := []struct {
-		name string
-		url  string
-		want string
-	}{
-		{
-			name: "non-blank Password",
-			url:  "https://user:password@host.tld/this:that",
-			want: "https://host.tld/this:that",
-		},
-		{
-			name: "blank Password",
-			url:  "https://user@host.tld/this:that",
-			want: "https://host.tld/this:that",
-		},
-		{
-			name: "blank Username",
-			url:  "https://:password@host.tld/this:that",
-			want: "https://host.tld/this:that",
-		},
-		{
-			name: "blank Username, blank Password",
-			url:  "https://host.tld/this:that",
-			want: "https://host.tld/this:that",
-		},
-		{
-			name: "invalid URL",
-			url:  "1https://foo.com",
-			want: "1https://foo.com",
-		},
-	}
-	for _, tt := range cases {
-		t.Run(tt.name, func(t *testing.T) {
-			if g, w := stripCredentials(tt.url), tt.want; g != w {
-				t.Fatalf("got: %q\nwant: %q", g, w)
-			}
-		})
-	}
-}
diff --git a/util/gitutil/gitutil.go b/util/gitutil/gitutil.go
index 97d939bf1..bfd3a4a01 100644
--- a/util/gitutil/gitutil.go
+++ b/util/gitutil/gitutil.go
@@ -2,12 +2,12 @@ package gitutil
 
 import (
 	"context"
-	"net/url"
 	"path/filepath"
 	"strings"
 
 	"github.com/docker/buildx/util/osutil"
 	bkgitutil "github.com/moby/buildkit/util/gitutil"
+	bkurlutil "github.com/moby/buildkit/util/urlutil"
 	"github.com/pkg/errors"
 )
 
@@ -62,16 +62,16 @@ func (cli *GitCLI) RemoteURL(ctx context.Context) (string, error) {
 	// Try default remote based on remote tracking branch.
 	if remote, err := cli.currentRemote(ctx); err == nil && remote != "" {
 		if ru, err := cli.clean(cli.Run(ctx, "remote", "get-url", remote)); err == nil && ru != "" {
-			return stripCredentials(ru), nil
+			return bkurlutil.RedactCredentials(ru), nil
 		}
 	}
 	// Next try to get the remote URL from the origin remote first.
 	if ru, err := cli.clean(cli.Run(ctx, "remote", "get-url", "origin")); err == nil && ru != "" {
-		return stripCredentials(ru), nil
+		return bkurlutil.RedactCredentials(ru), nil
 	}
 	// If that fails, try to get the remote URL from the upstream remote.
 	if ru, err := cli.clean(cli.Run(ctx, "remote", "get-url", "upstream")); err == nil && ru != "" {
-		return stripCredentials(ru), nil
+		return bkurlutil.RedactCredentials(ru), nil
 	}
 	return "", errors.New("no remote URL found for either origin or upstream")
 }
@@ -135,16 +135,3 @@ func IsUnknownRevision(err error) bool {
 	errMsg := strings.ToLower(err.Error())
 	return strings.Contains(errMsg, "unknown revision or path not in the working tree") || strings.Contains(errMsg, "bad revision")
 }
-
-// stripCredentials takes a URL and strips username and password from it.
-// e.g. "https://user:password@host.tld/path.git" will be changed to
-// "https://host.tld/path.git".
-// TODO: remove this function once fix from BuildKit is vendored here
-func stripCredentials(s string) string {
-	ru, err := url.Parse(s)
-	if err != nil {
-		return s // string is not a URL, just return it
-	}
-	ru.User = nil
-	return ru.String()
-}
diff --git a/vendor/github.com/moby/buildkit/util/urlutil/redact.go b/vendor/github.com/moby/buildkit/util/urlutil/redact.go
new file mode 100644
index 000000000..385e6aef8
--- /dev/null
+++ b/vendor/github.com/moby/buildkit/util/urlutil/redact.go
@@ -0,0 +1,33 @@
+package urlutil
+
+import (
+	"net/url"
+)
+
+const mask = "xxxxx"
+
+// RedactCredentials takes a URL and redacts username and password from it.
+// e.g. "https://user:password@host.tld/path.git" will be changed to
+// "https://xxxxx:xxxxx@host.tld/path.git".
+func RedactCredentials(s string) string {
+	ru, err := url.Parse(s)
+	if err != nil {
+		return s // string is not a URL, just return it
+	}
+	var (
+		hasUsername bool
+		hasPassword bool
+	)
+	if ru.User != nil {
+		hasUsername = len(ru.User.Username()) > 0
+		_, hasPassword = ru.User.Password()
+	}
+	if hasUsername && hasPassword {
+		ru.User = url.UserPassword(mask, mask)
+	} else if hasUsername {
+		ru.User = url.User(mask)
+	} else if hasPassword {
+		ru.User = url.UserPassword(ru.User.Username(), mask)
+	}
+	return ru.String()
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 5d5b5cc87..dafa7fa81 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -743,6 +743,7 @@ github.com/moby/buildkit/util/tracing/delegated
 github.com/moby/buildkit/util/tracing/detect
 github.com/moby/buildkit/util/tracing/env
 github.com/moby/buildkit/util/tracing/otlptracegrpc
+github.com/moby/buildkit/util/urlutil
 github.com/moby/buildkit/version
 # github.com/moby/docker-image-spec v1.3.1
 ## explicit; go 1.18