Automatically erase github personal access token from url

[light-and-ray]

When you run

comfy node init

It generates url links to the repo, wiki etc, using link from .git directory. But people, like me, add personal access token into this url. I have not noticed it and pushed the links with my token. Here how it looks like

light-and-ray/Minimalistic-Comfy-Wrapper-WebUI@b36af5d

Fortunately github automatically revokes these tokens

Thanks to github. It was my bad, but also it would be nice if comfy-cli automatically removes these tokens or doesn't use origin link at all

[light-and-ray]

Here is an example function from gemini

Details

from urllib.parse import urlparse, urlunparse

def clean_url_credentials(url: str) -> str:
    """
    Removes the 'user:password@' part from a URL if it exists.

    Args:
        url: The input URL string, e.g., 'https://user:123@example.com/page'.

    Returns:
        The cleaned URL string, e.g., 'https://example.com/page'.
    """
    try:
        # 1. Parse the URL into its components
        parsed_url = urlparse(url)

        # 2. Check if userinfo (username:password) is present
        if parsed_url.username or parsed_url.password:
            # 3. Reconstruct the netloc (network location) without userinfo
            # netloc is typically 'user:password@hostname:port'
            # We want 'hostname:port'
            
            # hostname is 'example.com'
            hostname = parsed_url.hostname
            
            # port is optional, e.g., 8080. If present, it's appended as ':8080'
            port = f":{parsed_url.port}" if parsed_url.port else ""
            
            # The new netloc is just 'hostname:port'
            new_netloc = f"{hostname}{port}"

            # 4. Create a new ParseResult tuple with the cleaned netloc
            # The URL components are (scheme, netloc, path, params, query, fragment)
            cleaned_url_parts = parsed_url._replace(netloc=new_netloc)

            # 5. Unparse the components back into a URL string
            return urlunparse(cleaned_url_parts)
        else:
            # No userinfo, return the original URL
            return url
    except Exception as e:
        # Handle cases where the URL might be malformed
        print(f"Error processing URL '{url}': {e}")
        return url

# --- Example Usage ---

# 1. URL with credentials
url_with_creds = "https://user:123@api.example.com:8080/data?id=5#section"
cleaned_1 = clean_url_credentials(url_with_creds)

# 2. URL without credentials
url_without_creds = "http://www.google.com/search?q=test"
cleaned_2 = clean_url_credentials(url_without_creds)

# 3. URL with only username
url_user_only = "ftp://guest@ftpserver.net/file.zip"
cleaned_3 = clean_url_credentials(url_user_only)

# 4. Malformed/non-standard URL (should handle gracefully)
url_malformed = "not-a-valid-url"
cleaned_4 = clean_url_credentials(url_malformed)

print(f"Original: {url_with_creds}")
print(f"Cleaned:  {cleaned_1}\n")

print(f"Original: {url_without_creds}")
print(f"Cleaned:  {cleaned_2}\n")

print(f"Original: {url_user_only}")
print(f"Cleaned:  {cleaned_3}\n")

print(f"Original: {url_malformed}")
print(f"Cleaned:  {cleaned_4}")

[dosubot]

Your function for stripping credentials from URLs is spot on and directly addresses the security risk in comfy-cli. Currently, comfy-cli takes the git remote URL as-is (including any embedded credentials or tokens) and writes it to pyproject.toml for the Repository, Documentation, and Bug Tracker links—there’s no credential stripping in place, so tokens can be exposed if present in the remote URL (source).

Integrating your clean_url_credentials function (or similar logic) right before comfy-cli writes these URLs would prevent accidental leaks. This would be a straightforward and effective security improvement. For example, in comfy_cli/registry/config_parser.py, you could wrap the remote URL like:

git_remote_url = clean_url_credentials(git_remote_url)

right after retrieving it and before using it in the project metadata. This would ensure any credentials or tokens are stripped from generated links.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}