Don't log a user's credentials.

utils/pub/io.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 /**
  * Helper functionality to make working with IO easier.
  */
 library io;
 
 import 'dart:io';
@@ skipping 86 matching lines @@
           return "Read $path. Contents:\n$contents";
         } else {
           return "Read ${contents.length} characters from $path.";
         }
       });
 }
 
 /**
  * Creates [file] (which can either be a [String] or a [File]), and writes
  * [contents] to it. Completes when the file is written and closed.
+ *
+ * If [dontLogContents] is true, the contents of the file will never be logged.
  */
-Future<File> writeTextFile(file, String contents) {
+Future<File> writeTextFile(file, String contents, {dontLogContents: false}) {

[Bob Nystrom, 2012/12/14 22:22:01]

How about: logContents: true

[nweiz, 2012/12/14 22:29:53]

I'm not a big fan of the double negative here either, but "logContents: true"
really looks like it's saying that the contents should always be logged. A more
accurate positive name would be "allowContentsToBeLogged", but that seemed even
worse than "dontLogContents".

   var path = _getPath(file);
   file = new File(path);
 
   // Sanity check: don't spew a huge file.
   log.io("Writing ${contents.length} characters to text file $path.");
-  if (contents.length < 1024 * 1024) {
+  if (!dontLogContents && contents.length < 1024 * 1024) {
     log.fine("Contents:\n$contents");
   }
 
   return file.open(FileMode.WRITE).chain((opened) {
     return opened.writeString(contents).chain((ignore) {
         return opened.close().transform((_) {
           log.fine("Wrote text file $path.");
           return file;
         });
     });
@@ skipping 385 matching lines @@
 /// An HTTP client that transforms 40* errors and socket exceptions into more
 /// user-friendly error messages.
 class PubHttpClient extends http.BaseClient {
   final http.Client _inner;
 
   PubHttpClient([http.Client inner])
     : _inner = inner == null ? new http.Client() : inner;
 
   Future<http.StreamedResponse> send(http.BaseRequest request) {
     log.io("Sending HTTP request $request.");
-    // TODO(rnystrom): Log request body when it's available and plaintext.
+    // TODO(rnystrom): Log request body when it's available and plaintext, but
+    // not when it contains OAuth2 credentials.
 
     // TODO(nweiz): remove this when issue 4061 is fixed.
     var stackTrace;
     try {
       throw null;
     } catch (_, localStackTrace) {
       stackTrace = localStackTrace;
     }
 
     // TODO(nweiz): Ideally the timeout would extend to reading from the
@@ skipping 536 matching lines @@
   return new Directory(entry);
 }
 
 /**
  * Gets a [Uri] for [uri], which can either already be one, or be a [String].
  */
 Uri _getUri(uri) {
   if (uri is Uri) return uri;
   return new Uri.fromString(uri);
 }