Hide passwords in hovering URLs

qutebrowser/mainwindow/statusbar/url.py

@@ -153,7 +153,7 @@ class UrlText(textbase.TextBase):
             _text: The text of the hovered link (string)
         """
         if link:
-            self._hover_url = QUrl(link).toString()
+            self._hover_url = QUrl(link).toDisplayString()
         else:
             self._hover_url = None
         self._update_url()

tests/unit/mainwindow/statusbar/test_url.py

@@ -94,6 +94,7 @@ def test_set_hover_url(url_widget, url_text, title, text):
     ('http://test.ru/%D0%B0%D0%B1%D0%B2%D0%B3.txt', 'http://test.ru/абвг.txt'),
     ('http://test.com/s%20p%20a%20c%20e.txt', 'http://test.com/s p a c e.txt'),
     ('http://test.com/%22quotes%22.html', 'http://test.com/%22quotes%22.html'),
+    ('http://username:secret%20password@test.com', 'http://username@test.com')
 ])
 def test_set_hover_url_encoded(url_widget, url_text, expected):
     """Test text when hovering over a percent encoded link."""