From: Michael Albinus <michael.albinus@gmx.de>
To: emacs-devel@gnu.org
Cc: "Michael R. Mauger" <michael@mauger.com>
Subject: Re: master 3df7d06: Added `comint-password-function' hook
Date: Mon, 23 Dec 2019 11:24:56 +0100 [thread overview]
Message-ID: <87woanjq4n.fsf@gmx.de> (raw)
In-Reply-To: <20191223050617.2BA89212AC@vcs0.savannah.gnu.org> (mmaug's message of "Mon, 23 Dec 2019 00:06:16 -0500 (EST)")
mmaug--- via Mailing list for Emacs changes <emacs-diffs@gnu.org>
writes:
Hi Michael,
> --- a/etc/NEWS
> +++ b/etc/NEWS
> @@ -1131,6 +1131,19 @@ end.
> *** 'comint-run' can now accept a list of switches to pass to the program.
> 'C-u M-x comint-run' will prompt for the switches interactively.
>
> +*** Abnormal hook `comint-password-function' has been added.
> +This hook permits a derived mode to supply a password for the
> +underlying command interpreter without prompting the user. For
> +example, in sql-mode, the password for connecting to the database may
> +be stored in the connection wallet and may be passed on the command
> +line to start the SQL interpreter. This is a potential security flaw
> +that could expose user's database passwords on the command line
> +through the use of a process list (Bug#8427). With this hook, it is
> +possible to not pass the password on the command line and wait for the
> +program to prompt for the password. When it does so, the password cam
> +be supplied to the SQL interpreter without involving the user just as
> +if it had been supplied on the command line.
Shouldn't this be documented in the manual, or at least in the
docstring? etc/NEWS is not the preferred place to look for
documentation, except when a new Emacs release arrives.
Furthermore, we don't mention bug numbers in etc/NEWS.
Best regards, Michael.
next parent reply other threads:[~2019-12-23 10:24 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20191223050615.10479.33674@vcs0.savannah.gnu.org>
[not found] ` <20191223050617.2BA89212AC@vcs0.savannah.gnu.org>
2019-12-23 10:24 ` Michael Albinus [this message]
2019-12-23 14:01 ` master 3df7d06: Added `comint-password-function' hook Eli Zaretskii
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87woanjq4n.fsf@gmx.de \
--to=michael.albinus@gmx.de \
--cc=emacs-devel@gnu.org \
--cc=michael@mauger.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).