Merge 7222bb2a10 into a15dd75d98

news/9973.bugfix.rst

@@ -0,0 +1 @@
+Mask the user when the password is empty.

src/pip/_internal/utils/misc.py

@@ -507,12 +507,13 @@ def redact_netloc(netloc: str) -> str:
 
     For example:
         - "user:pass@example.com" returns "user:****@example.com"
+        - "user:@example.com" returns "****@example.com"
         - "accesstoken@example.com" returns "****@example.com"
     """
     netloc, (user, password) = split_auth_from_netloc(netloc)
     if user is None:
         return netloc
-    if password is None:
+    if not password:
         user = "****"
         password = ""
     else: