Don't log a user's credentials.

utils/pub/io.dart

Index: utils/pub/io.dart
diff --git a/utils/pub/io.dart b/utils/pub/io.dart
index 39a854d846bd0e9181c552b00fa1ecff227a9a5a..c7e3b04625a1a91b023e39bcd87561f5a8509b27 100644
--- a/utils/pub/io.dart
+++ b/utils/pub/io.dart
@@ -104,14 +104,16 @@ Future<String> readTextFile(file) {
 /**
  * Creates [file] (which can either be a [String] or a [File]), and writes
  * [contents] to it. Completes when the file is written and closed.
+ *
+ * If [dontLogContents] is true, the contents of the file will never be logged.
  */
-Future<File> writeTextFile(file, String contents) {
+Future<File> writeTextFile(file, String contents, {dontLogContents: false}) {

[Bob Nystrom, 2012/12/14 22:22:01]

How about: logContents: true

[nweiz, 2012/12/14 22:29:53]

I'm not a big fan of the double negative here either, but "logContents: true"
really looks like it's saying that the contents should always be logged. A more
accurate positive name would be "allowContentsToBeLogged", but that seemed even
worse than "dontLogContents".

   var path = _getPath(file);
   file = new File(path);
 
   // Sanity check: don't spew a huge file.
   log.io("Writing ${contents.length} characters to text file $path.");
-  if (contents.length < 1024 * 1024) {
+  if (!dontLogContents && contents.length < 1024 * 1024) {
     log.fine("Contents:\n$contents");
   }
 
@@ -517,7 +519,8 @@ class PubHttpClient extends http.BaseClient {
 
   Future<http.StreamedResponse> send(http.BaseRequest request) {
     log.io("Sending HTTP request $request.");
-    // TODO(rnystrom): Log request body when it's available and plaintext.
+    // TODO(rnystrom): Log request body when it's available and plaintext, but
+    // not when it contains OAuth2 credentials.
 
     // TODO(nweiz): remove this when issue 4061 is fixed.
     var stackTrace;