Censor response bodies from Mercurial error messages
Ref T6755. In Git and Subversion, running git clone http://google.com/ or svn checkout http://google.com/ does not echo the response body.
In Mercurial, it does. Censor it from the output of hg pull and hg clone. This prevents an attacker from:
- Creating a Mercurial remote repository with URI http://10.0.0.1/secrets/; and
- reading the secrets out of the error message after the clone fails.
Test Plan: Set a Mercurial remote URI to a non-Mercurial repository, ran repository update, saw censored error message.
Reviewed By: btrahan
Maniphest Tasks: T6755
Differential Revision: https://secure.phabricator.com/D12170