bug#37636: 26.1; comint password prompt regexp doesn't handle python twine prompting for password

bug#37636: 26.1; comint password prompt regexp doesn't handle python twine prompting for password

[Toby Ferguson]

[-- Attachment #1: Type: text/plain, Size: 7897 bytes --]

--text follows this line--

When I attempt to execute a command in a bash shell using python the python
command prompts for a password and that password prompt isn't hidden. In
what follows I'll replace my real password with the string FARGLE. Here's
the offending interaction in a bash shell buffer:

(cdp_validator) bash-4.4$ python3 -m twine upload  dist/*
Enter your usErname: toby.h.ferguson
Enter your password: FARGLE

As you can see, the password isn't hidden at all :-(

Executing the following elisp fixed the problem:

(setq comint-password-prompt-regexp
      (concat comint-password-prompt-regexp
              "\\|^Enter your password:.*"))

The general task here that the python is executing is pretty common:
uploading a package to PyPi.  So I would ask that you add that string as a
default to the comint-password-prompt-regexp


In GNU Emacs 26.1 (build 1, x86_64-apple-darwin14.5.0, NS appkit-1348.17
Version 10.10.5 (Build 14F2511))
 of 2018-05-30 built on builder10-10.porkrind.org
Windowing system distributor 'Apple', version 10.3.1671
Recent messages:
No mode command-log found [3 times]
Type "q" in help window to restore its previous buffer.
No mode command-log found [5 times]
Type C-x 4 C-o RET to restore the other window.
No mode command-log found [3 times]
Quit
No mode command-log found [3 times]
Quit
No mode command-log found [9 times]
Type "q" to restore previous buffer.

Configured using:
 'configure --with-ns '--enable-locallisppath=/Library/Application
 Support/Emacs/${version}/site-lisp:/Library/Application
 Support/Emacs/site-lisp' --with-modules'

Configured features:
NOTIFY ACL GNUTLS LIBXML2 ZLIB TOOLKIT_SCROLL_BARS NS MODULES THREADS

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Shell

Minor modes in effect:
  global-magit-file-mode: t
  magit-auto-revert-mode: t
  global-git-commit-mode: t
  async-bytecomp-package-mode: t
  hl-line-mode: t
  projectile-mode: t
  ido-yes-or-no-mode: t
  global-company-mode: t
  company-mode: t
  pyvenv-mode: t
  shell-dirtrack-mode: t
  global-linum-mode: t
  linum-mode: t
  my/global-pair-programming-mode: t
  my/pair-programming-mode: t
  display-time-mode: t
  nyan-mode: t
  global-git-gutter-mode: t
  diff-auto-refine-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
/Users/toby/.emacs.d/elpa/circe-2.11/shorten hides
/Users/toby/.emacs.d/elpa/tracking-2.11/shorten
/Users/toby/.emacs.d/elpa/circe-2.11/tracking hides
/Users/toby/.emacs.d/elpa/tracking-2.11/tracking

Features:
(shadow sort mail-extr emacsbug sendmail apropos cl-print cal-move
bug-reference dabbrev markdown-mode browse-url tmm pcmpl-unix pcmpl-gnu
magit-bookmark bookmark tabify org-capture timezone make-mode eieio-opt
speedbar sb-image ezimage dframe magit-gitignore ediff-merg ediff-wind
ediff-diff ediff-mult ediff-help ediff-init ediff-util ediff js
sgml-mode dom cc-mode cc-fonts cc-guess cc-menus cc-cmds cc-styles
cc-align cc-engine cc-vars cc-defs smex dired-aux flyspell ispell
magit-extras misearch multi-isearch magit-submodule magit-obsolete
magit-blame magit-stash magit-bisect magit-push magit-pull magit-fetch
magit-clone magit-remote magit-commit magit-sequence magit-notes
magit-worktree magit-tag magit-merge magit-branch magit-reset
magit-collab ghub-graphql treepy graphql ghub let-alist magit-files
magit-refs magit-status magit magit-repos magit-apply magit-wip
magit-log which-func imenu magit-diff smerge-mode magit-core
magit-autorevert autorevert filenotify magit-process magit-margin
magit-mode git-commit magit-git magit-section magit-utils magit-popup
crm log-edit pcvs-util add-log with-editor async-bytecomp async
image-file pp diminish company-oddmuse company-keywords company-etags
company-gtags company-dabbrev-code company-dabbrev company-files
company-cmake company-xcode company-clang company-semantic company-eclim
company-template company-bbdb hl-line server ob-ditaa ob-dot ob-plantuml
ob-shell ob-python ox-odt rng-loc rng-uri rng-parse rng-match rng-dt
rng-util rng-pttrn nxml-parse nxml-ns nxml-enc xmltok nxml-util ox-md
ox-latex ox-icalendar ox-html table ox-ascii ox-publish ox org-protocol
org-agenda projectile-direnv projectile ibuf-ext ibuffer
ibuffer-loaddefs ido-yes-or-no py-autopep8 yasnippet
highlight-indentation flymake-proc flymake warnings company-capf company
pcase help-fns radix-tree elpy find-file-in-project ivy delsel colir
color ivy-overlay ffap thingatpt windmove elpy-shell pyvenv esh-var
esh-io esh-cmd esh-opt esh-ext esh-proc esh-arg esh-groups eshell
esh-module esh-mode esh-util elpy-profile elpy-django s elpy-refactor
python tramp-sh tramp tramp-compat tramp-loaddefs trampver shell ido
grep compile files-x etags xref project cus-edit cus-start cus-load
linum flycheck-joker flycheck json map rx subr-x dash paredit edmacro
kmacro string-inflection time nyan-mode smart-mode-line-dark-theme
smart-mode-line rich-minority git-gutter-fringe fringe-helper git-gutter
leuven-theme exec-path-from-shell elec-pair org-id cl-extra help-mode
vc-git diff-mode org-rmail org-mhe org-irc org-info org-gnus nnir
gnus-sum gnus-group gnus-undo gnus-start gnus-cloud nnimap nnmail
mail-source utf7 netrc nnoo parse-time gnus-spec gnus-int gnus-range
gnus-win gnus nnheader wid-edit org-docview doc-view jka-compr
image-mode org-bibtex bibtex org-bbdb org-w3m org-element avl-tree
generator org org-macro org-footnote org-pcomplete pcomplete org-list
org-faces org-entities noutline outline easy-mmode org-version
ob-emacs-lisp ob ob-tangle org-src ob-ref ob-lob ob-table ob-keys ob-exp
ob-comint comint ansi-color ring ob-core ob-eval org-compat org-macs
org-loaddefs find-func cal-menu calendar cal-loaddefs mm-archive message
dired dired-loaddefs format-spec rfc822 mml mml-sec epa derived epg
gnus-util rmail rmail-loaddefs mailabbrev gmm-utils mailheader mm-decode
mm-bodies mm-encode mail-utils network-stream starttls url-http tls
gnutls mail-parse rfc2231 rfc2047 rfc2045 mm-util ietf-drums mail-prsvr
url-gw nsm rmc puny url-cache url-auth url url-proxy url-privacy
url-expand url-methods url-history url-cookie url-domsuf url-util
mailcap finder-inf tex-site advice info package easymenu epg-config
url-handlers url-parse auth-source cl-seq eieio eieio-core cl-macs
eieio-loaddefs password-cache url-vars seq byte-opt gv bytecomp
byte-compile cconv cl-loaddefs cl-lib time-date tooltip eldoc electric
uniquify ediff-hook vc-hooks lisp-float-type mwheel term/ns-win ns-win
ucs-normalize mule-util term/common-win tool-bar dnd fontset image
regexp-opt fringe tabulated-list replace newcomment text-mode elisp-mode
lisp-mode prog-mode register page menu-bar rfn-eshadow isearch timer
select scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame cl-generic cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932
hebrew greek romanian slovak czech european ethiopic indian cyrillic
chinese composite charscript charprop case-table epa-hook jka-cmpr-hook
help simple abbrev obarray minibuffer cl-preloaded nadvice loaddefs
button faces cus-face macroexp files text-properties overlay sha1 md5
base64 format env code-pages mule custom widget hashtable-print-readable
backquote kqueue cocoa ns multi-tty make-network-process emacs)

Memory information:
((conses 16 870130 162407)
 (symbols 48 59398 292)
 (miscs 40 14789 2602)
 (strings 32 202499 13230)
 (string-bytes 1 6251882)
 (vectors 16 101601)
 (vector-slots 8 2298478 97758)
 (floats 8 578 1980)
 (intervals 56 26847 5347)
 (buffers 992 75))
toby | +1 408 386 9343

[-- Attachment #2: Type: text/html, Size: 8816 bytes --]

bug#37636: 26.1; comint password prompt regexp doesn't handle python twine prompting for password

[Stefan Kangas]

[-- Attachment #1: Type: text/plain, Size: 1388 bytes --]

Toby Ferguson <toby.h.ferguson@gmail.com> writes:

> When I attempt to execute a command in a bash shell using python the python command prompts for a password and that password prompt isn't hidden. In what follows I'll replace my real password with the string FARGLE. Here's the offending interaction in a bash shell buffer:
>
> (cdp_validator) bash-4.4$ python3 -m twine upload  dist/*
> Enter your usErname: toby.h.ferguson
> Enter your password: FARGLE
>
> As you can see, the password isn't hidden at all :-(
>
> Executing the following elisp fixed the problem:
>
> (setq comint-password-prompt-regexp
>       (concat comint-password-prompt-regexp
>               "\\|^Enter your password:.*"))
>
> The general task here that the python is executing is pretty common: uploading a package to PyPi.  So I would ask that you add that string as a default to the comint-password-prompt-regexp

Thank you for the bug report.

I believe that this has already been fixed on the current master
branch.  When I added the string "Enter your password: " to the test
suite for comint-password-prompt-regexp, the test passed with no
further changes.

You could try building the current master branch to verify that this
works for you.  I've attached a patch containing an addition to the
test suite which I'll push to the master branch.

Best regards,
Stefan Kangas

[-- Attachment #2: 0001-Add-new-example-to-comint-password-prompt-tests.patch --]
[-- Type: text/x-patch, Size: 1001 bytes --]

From 3f6c81ca36b99e444bc6fc49b2736852840557ce Mon Sep 17 00:00:00 2001
From: Stefan Kangas <stefankangas@gmail.com>
Date: Sun, 6 Oct 2019 03:08:27 +0200
Subject: [PATCH] Add new example to comint-password-prompt tests

* test/lisp/comint-tests.el (comint-testsuite-password-strings):
Add new example to test suite.  (Bug#37636)
---
 test/lisp/comint-tests.el | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/lisp/comint-tests.el b/test/lisp/comint-tests.el
index 09f10879f9..9f23967fee 100644
--- a/test/lisp/comint-tests.el
+++ b/test/lisp/comint-tests.el
@@ -34,6 +34,7 @@ comint-testsuite-password-strings
     "Enter passphrase: " ; ssh-add
     "Enter passphrase (empty for no passphrase): " ; ssh-keygen
     "Enter same passphrase again: "     ; ssh-keygen
+    "Enter your password: "             ; python3 -m twine upload Bug#37636
     "Passphrase for key root@GNU.ORG: " ; plink
     "[sudo] password for user:" ; Ubuntu sudo
     "[sudo] user 的密码：" ; localized
-- 
2.20.1

bug#37636: 26.1; comint password prompt regexp doesn't handle python twine prompting for password

[Stefan Kangas]

close 37636 27.1
quit

Stefan Kangas <stefan@marxist.se> writes:

> I've attached a patch containing an addition to the
> test suite which I'll push to the master branch.

Now pushed as commit 9839466b23. Closing.

Best regards,
Stefan Kangas