gh-90996: Fixed the issue that the xmlrpc module throws a ProtocolError which may leak the password

Lib/xmlrpc/client.py

@@ -1167,8 +1167,9 @@ def single_request(self, host, handler, request_body, verbose=False):
         #Discard any response data and raise exception
         if resp.getheader("content-length", ""):
             resp.read()
+        uname = f'{host.split(':')[0]}@{host.split('@')[1]}'
         raise ProtocolError(
-            host + handler,
+            uname + handler,
             resp.status, resp.reason,
             dict(resp.getheaders())
             )

Misc/NEWS.d/next/Library/2024-09-13-20-48-05.gh-issue-90996.MPGcGC.rst

@@ -0,0 +1,3 @@
+fixed security issue where passwords might get leaked because of
+``ProtocolError`` thrown by the :meth:`xmlrpc.client.Transport.single_request`
+in the :mod:`xmlrpc.client`