Merge 7222bb2a10 into a15dd75d98

Empty passwords can be associated with access tokens.
Avoid disclosing them.

docs/html/cli/pip_install.rst

@@ -45,8 +45,8 @@ When looking at the items to be installed, pip checks what type of item
 each is, in the following order:
 
 1. Project or archive URL.
-2. Local directory (which must contain a ``setup.py``, or pip will report
-   an error).
+2. Local directory (which must contain a ``pyproject.toml`` or ``setup.py``,
+   otherwise pip will report an error).
 3. Local file (a sdist or wheel format archive, following the naming
    conventions for those formats).
 4. A requirement, as specified in :pep:`440`.

news/12417.doc.rst

@@ -0,0 +1 @@
+Fix outdated pip install argument description in documentation.

news/9973.bugfix.rst

@@ -0,0 +1 @@
+Mask the user when the password is empty.

src/pip/_internal/utils/misc.py

@@ -507,12 +507,13 @@ def redact_netloc(netloc: str) -> str:
 
     For example:
         - "user:pass@example.com" returns "user:****@example.com"
+        - "user:@example.com" returns "****@example.com"
         - "accesstoken@example.com" returns "****@example.com"
     """
     netloc, (user, password) = split_auth_from_netloc(netloc)
     if user is None:
         return netloc
-    if password is None:
+    if not password:
         user = "****"
         password = ""
     else: