feat: forbid credentials in git url

This is to minimize the risk of credential leaks, see discussion: helm/community#321 (comment)

Signed-off-by: Dominykas Blyžė <[email protected]>

Author: dominykas

pkg/downloader/chart_downloader.go

@@ -214,6 +214,9 @@ func (c *ChartDownloader) ResolveChartVersion(ref, version string) (*url.URL, er
 		if err != nil {
 			return nil, errors.Errorf("invalid git URL format: %s", gitURL)
 		}
+		if u.User != nil {
+			return nil, errors.Errorf("git repository URL should not contain credentials - please use git credential helpers")
+		}
 		return u, nil
 	}
 	u, err := url.Parse(ref)

pkg/downloader/chart_downloader_test.go

@@ -43,6 +43,7 @@ func TestResolveChartRef(t *testing.T) {
 		{name: "full URL, with authentication", ref: "http://username:[email protected]/foo-1.2.3.tgz", expect: "http://username:[email protected]/foo-1.2.3.tgz"},
 		{name: "helmchart", ref: "git+https://github.com/helmchart/helmchart.git", expect: "https://github.com/helmchart/helmchart.git"},
 		{name: "helmchart", ref: "git://github.com/helmchart/helmchart.git", expect: "git://github.com/helmchart/helmchart.git"},
+		{name: "helmchart", ref: "git+https://username:[email protected]/helmchart/helmchart.git", expectError: "git repository URL should not contain credentials - please use git credential helpers"},
 		{name: "reference, testing repo", ref: "testing/alpine", expect: "http://example.com/alpine-1.2.3.tgz"},
 		{name: "reference, version, testing repo", ref: "testing/alpine", version: "0.2.0", expect: "http://example.com/alpine-0.2.0.tgz"},
 		{name: "reference, version, malformed repo", ref: "malformed/alpine", version: "1.2.3", expect: "http://dl.example.com/alpine-1.2.3.tgz"},