From 8bc9c33b3661fa8f14d8f5b21c0c381953975a1a Mon Sep 17 00:00:00 2001
From: Noah Gorny <noah@gittabags.com>
Date: Wed, 2 Dec 2020 22:53:43 +0200
Subject: [PATCH 1/3] tests: Add extra_index_url test case to help redact url

---
 tests/functional/test_help.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/functional/test_help.py b/tests/functional/test_help.py
index 9c2508abb51..a660cdf520d 100644
--- a/tests/functional/test_help.py
+++ b/tests/functional/test_help.py
@@ -74,6 +74,17 @@ def test_help_command_redact_auth_from_url(script):
     assert 'secret' not in result.stdout
 
 
+def test_help_command_redact_auth_from_url_with_extra_index_url(script):
+    """
+    Test `help` on various subcommands redact auth from url with extra index url
+    """
+    script.environ['PIP_INDEX_URL'] = 'https://user:secret@example.com'
+    script.environ['PIP_EXTRA_INDEX_URL'] = 'https://user:secret@example2.com'
+    result = script.pip('install', '--help')
+    assert result.returncode == SUCCESS
+    assert 'secret' not in result.stdout
+
+
 def test_help_commands_equally_functional(in_memory_pip):
     """
     Test if `pip help` and 'pip --help' behave the same way.

From 5cfd8a7c3ec791c26616005a688db226fd767549 Mon Sep 17 00:00:00 2001
From: Noah Gorny <noah@gittabags.com>
Date: Wed, 2 Dec 2020 22:56:03 +0200
Subject: [PATCH 2/3] Handle case of list default values in
 UpdatingDefaultsHelpFormatter

Happens because we pass a list from --extra-index-url
---
 news/9191.bugfix.rst            |  2 ++
 src/pip/_internal/cli/parser.py | 18 +++++++++++++-----
 2 files changed, 15 insertions(+), 5 deletions(-)
 create mode 100644 news/9191.bugfix.rst

diff --git a/news/9191.bugfix.rst b/news/9191.bugfix.rst
new file mode 100644
index 00000000000..436f2f2dd29
--- /dev/null
+++ b/news/9191.bugfix.rst
@@ -0,0 +1,2 @@
+Handle case of list default values in UpdatingDefaultsHelpFormatter
+Happens because we pass a list from --extra-index-url
diff --git a/src/pip/_internal/cli/parser.py b/src/pip/_internal/cli/parser.py
index ea3b383e2f7..7170bfd3841 100644
--- a/src/pip/_internal/cli/parser.py
+++ b/src/pip/_internal/cli/parser.py
@@ -112,15 +112,23 @@ class UpdatingDefaultsHelpFormatter(PrettyHelpFormatter):
     """
 
     def expand_default(self, option):
-        default_value = None
+        default_values = None
         if self.parser is not None:
             self.parser._update_defaults(self.parser.defaults)
-            default_value = self.parser.defaults.get(option.dest)
+            default_values = self.parser.defaults.get(option.dest)
         help_text = optparse.IndentedHelpFormatter.expand_default(self, option)
 
-        if default_value and option.metavar == 'URL':
-            help_text = help_text.replace(
-                default_value, redact_auth_from_url(default_value))
+        if default_values and option.metavar == 'URL':
+            if isinstance(default_values, string_types):
+                default_values = [default_values]
+
+            # If its not a list, we should abort and just return the help text
+            if not isinstance(default_values, list):
+                default_values = []
+
+            for val in default_values:
+                help_text = help_text.replace(
+                    val, redact_auth_from_url(val))
 
         return help_text
 

From 8de94b5740ac0fb83f3dc899c9d4f23d85ed82c0 Mon Sep 17 00:00:00 2001
From: Pradyun Gedam <3275593+pradyunsg@users.noreply.github.com>
Date: Tue, 8 Dec 2020 12:55:52 +0000
Subject: [PATCH 3/3] Update news/9191.bugfix.rst

---
 news/9191.bugfix.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/news/9191.bugfix.rst b/news/9191.bugfix.rst
index 436f2f2dd29..e1c6d633de9 100644
--- a/news/9191.bugfix.rst
+++ b/news/9191.bugfix.rst
@@ -1,2 +1,2 @@
-Handle case of list default values in UpdatingDefaultsHelpFormatter
-Happens because we pass a list from --extra-index-url
+Fix crash when logic for redacting authentication information from URLs
+in ``--help`` is given a list of strings, instead of a single string.