--help output does not redact password from configured index_url

[cdunklau-dt]

Environment

• pip version: 20.2.4
• Python version: 3.8.6
• OS: Windows 10

Description

The help text for at least the install and wheel subcommands (likely others too) display the full configured index URL as a default, without redacting credentials:

Package Index Options:
  -i, --index-url <url>       Base URL of the Python Package Index (default https://us
                              er:[email protected]/api/pypi/simple). This
                              should point to a repository compliant with PEP 503 (the
                              simple repository API) or a local directory laid out in
                              the same format.

The URL is coming from pip.ini in C:\Users\cdunklau\AppData\Roaming\pip\pip.ini:

[global]
index-url = https://user:[email protected]/api/pypi/simple

Expected behavior

Pip should redact the password, as it does in log entries involving a custom index URL, e.g.:

Package Index Options:
  -i, --index-url <url>       Base URL of the Python Package Index (default https://us
                              er:****@mypypi.example.com/api/pypi/simple). This
                              should point to a repository compliant with PEP 503 (the
                              simple repository API) or a local directory laid out in
                              the same format.

How to Reproduce

1. Configure a custom index-url in pip.ini with credentials, as above
2. Run pip install --help
3. Observe the password is not redacted in the help text

[NoahGorny]

@xavfernandez @cdunklau-dt you are welcome to look on my PR #9163 which solves this problem 😄