Re: master 3df7d06: Added `comint-password-function' hook

[Eli Zaretskii <eliz@gnu.org>]

> From: Michael Albinus <michael.albinus@gmx.de>
> Date: Mon, 23 Dec 2019 11:24:56 +0100
> Cc: "Michael R. Mauger" <michael@mauger.com>
> 
> > +*** Abnormal hook `comint-password-function' has been added.
> > +This hook permits a derived mode to supply a password for the
> > +underlying command interpreter without prompting the user.  For
> > +example, in sql-mode, the password for connecting to the database may
> > +be stored in the connection wallet and may be passed on the command
> > +line to start the SQL interpreter.  This is a potential security flaw
> > +that could expose user's database passwords on the command line
> > +through the use of a process list (Bug#8427).  With this hook, it is
> > +possible to not pass the password on the command line and wait for the
> > +program to prompt for the password.  When it does so, the password cam
> > +be supplied to the SQL interpreter without involving the user just as
> > +if it had been supplied on the command line.
> 
> Shouldn't this be documented in the manual, or at least in the
> docstring?

It should.

> Furthermore, we don't mention bug numbers in etc/NEWS.

Right.

Patches with corrections are welcome.  Thanks.