#601 Strip user info from Azure DevOps repository link

When creating the link from Sonarqube to an Azure Devops Pull Request,
the URL of the owning repository is used as a base for the URL. If the
Azure DevOps API returns a URL containing user authentication details
then this is included in the resulting link, even though the details
may not be valid for a front-end user. The authentication detail is
therefore being stripped from the URL before the Pull Request URL is
generated.

src/main/java/com/github/mc1arke/sonarqube/plugin/ce/pullrequest/azuredevops/AzureDevOpsPullRequestDecorator.java

@@ -43,13 +43,17 @@
 import com.github.mc1arke.sonarqube.plugin.ce.pullrequest.report.ReportGenerator;
 import org.apache.commons.lang.StringUtils;
 import org.sonar.api.ce.posttask.QualityGate;
+import org.sonar.api.utils.log.Logger;
+import org.sonar.api.utils.log.Loggers;
 import org.sonar.ce.task.projectanalysis.scm.ScmInfoRepository;
 import org.sonar.db.alm.setting.ALM;
 import org.sonar.db.alm.setting.AlmSettingDto;
 import org.sonar.db.alm.setting.ProjectAlmSettingDto;
 import org.sonar.db.protobuf.DbIssues;
 
 import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
@@ -58,6 +62,7 @@
 
 public class AzureDevOpsPullRequestDecorator extends DiscussionAwarePullRequestDecorator<AzureDevopsClient, PullRequest, Void, CommentThread, Comment> implements PullRequestBuildStatusDecorator {
 
+    private static final Logger logger = Loggers.get(AzureDevOpsPullRequestDecorator.class);
     private static final Pattern NOTE_MARKDOWN_LEGACY_SEE_LINK_PATTERN = Pattern.compile("^\\[See in SonarQube]\\((.*?)\\)$");
     private final AzureDevopsClientFactory azureDevopsClientFactory;
     private final MarkdownFormatterFactory markdownFormatterFactory;
@@ -82,7 +87,14 @@ protected AzureDevopsClient createClient(AlmSettingDto almSettingDto, ProjectAlm
 
     @Override
     protected Optional<String> createFrontEndUrl(PullRequest pullRequest, AnalysisDetails analysisDetails) {
-        return Optional.of(pullRequest.getRepository().getRemoteUrl() + "/pullRequest/" + pullRequest.getId());
+        String targetUri = pullRequest.getRepository().getRemoteUrl();
+        try {
+            URI uri = new URI(targetUri);
+            targetUri = new URI(uri.getScheme(), null, uri.getHost(), uri.getPort(), uri.getPath(), null, null).toString();
+        } catch (URISyntaxException ex) {
+            logger.warn("Could not construct normalised URI for Pull Request link. Unparsed URL will be used instead", ex);
+        }
+        return Optional.of(targetUri + "/pullRequest/" + pullRequest.getId());
     }
 
     @Override

src/test/java/com/github/mc1arke/sonarqube/plugin/ce/pullrequest/azuredevops/AzureDevOpsPullRequestDecoratorTest.java

@@ -2,6 +2,8 @@
 
 import com.github.mc1arke.sonarqube.plugin.almclient.azuredevops.AzureDevopsClientFactory;
 import com.github.mc1arke.sonarqube.plugin.almclient.azuredevops.DefaultAzureDevopsClientFactory;
+import com.github.mc1arke.sonarqube.plugin.almclient.azuredevops.model.PullRequest;
+import com.github.mc1arke.sonarqube.plugin.almclient.azuredevops.model.Repository;
 import com.github.mc1arke.sonarqube.plugin.ce.pullrequest.AnalysisDetails;
 import com.github.mc1arke.sonarqube.plugin.ce.pullrequest.DecorationResult;
 import com.github.mc1arke.sonarqube.plugin.ce.pullrequest.PostAnalysisIssueVisitor;
@@ -584,4 +586,24 @@ public void decorateQualityGateStatusClosedIssue() {
         assertThat(result.getPullRequestUrl()).isEqualTo(Optional.of(String.format("%s/%s/_git/%s/pullRequest/%s", wireMockRule.baseUrl(), azureProject, azureRepository, pullRequestId)));
     }
 
+    @Test
+    public void shouldRemoveUserInfoFromRepositoryUrlForLinking() {
+        ScmInfoRepository scmInfoRepository = mock(ScmInfoRepository.class);
+        AzureDevopsClientFactory azureDevopsClientFactory = mock(AzureDevopsClientFactory.class);
+        ReportGenerator reportGenerator = mock(ReportGenerator.class);
+        MarkdownFormatterFactory markdownFormatterFactory = mock(MarkdownFormatterFactory.class);
+
+        AzureDevOpsPullRequestDecorator underTest = new AzureDevOpsPullRequestDecorator(scmInfoRepository, azureDevopsClientFactory, reportGenerator, markdownFormatterFactory);
+
+        Repository repository = mock(Repository.class);
+        when(repository.getRemoteUrl()).thenReturn("https://[email protected]/path/to/repo");
+        PullRequest pullRequest = mock(PullRequest.class);
+        when(pullRequest.getRepository()).thenReturn(repository);
+        when(pullRequest.getId()).thenReturn(999);
+
+        AnalysisDetails analysisDetails = mock(AnalysisDetails.class);
+
+        assertThat(underTest.createFrontEndUrl(pullRequest, analysisDetails)).contains("https://domain.com/path/to/repo/pullRequest/999");
+    }
+
 }