* bug#43302: password shows up in shell buffer (27.1)
@ 2020-09-10 0:40 Nicholas Drozd
2020-09-10 12:26 ` Robert Pluim
2021-01-27 6:20 ` Lars Ingebrigtsen
0 siblings, 2 replies; 5+ messages in thread
From: Nicholas Drozd @ 2020-09-10 0:40 UTC (permalink / raw)
To: 43302
The password input starring in shell mode seems to have changed in 27
from 26 to become more lax. Here is a small shell script:
#+begin_src shell
echo "Password:"
read -sr password
#+end_src
In 26, it looks like this when I run it:
#+begin_quote
$ bash password.sh
Password:
$
#+end_quote
The password is input starred into the minibuffer, not in the shell
buffer itself.
In 27, it looks like this:
#+begin_src
$ bash password.sh
Password:
asdf
$
#+end_src
The password (=asdf=) gets input directly into the shell buffer, unstarred.
I have tried on both Linux and Mac.
This may be related to
https://lists.gnu.org/archive/html/bug-gnu-emacs/2020-09/msg00028.html
^ permalink raw reply [flat|nested] 5+ messages in thread
* bug#43302: password shows up in shell buffer (27.1)
2020-09-10 0:40 bug#43302: password shows up in shell buffer (27.1) Nicholas Drozd
@ 2020-09-10 12:26 ` Robert Pluim
2021-01-27 6:20 ` Lars Ingebrigtsen
1 sibling, 0 replies; 5+ messages in thread
From: Robert Pluim @ 2020-09-10 12:26 UTC (permalink / raw)
To: Nicholas Drozd; +Cc: 43302
>>>>> On Wed, 9 Sep 2020 19:40:04 -0500, Nicholas Drozd <nicholasdrozd@gmail.com> said:
Nicholas> This may be related to
Nicholas> https://lists.gnu.org/archive/html/bug-gnu-emacs/2020-09/msg00028.html
The patch for that is in master, not in emacs-27, so something else is
going on.
Robert
^ permalink raw reply [flat|nested] 5+ messages in thread
* bug#43302: password shows up in shell buffer (27.1)
2020-09-10 0:40 bug#43302: password shows up in shell buffer (27.1) Nicholas Drozd
2020-09-10 12:26 ` Robert Pluim
@ 2021-01-27 6:20 ` Lars Ingebrigtsen
2021-02-12 20:50 ` Nicholas Drozd
1 sibling, 1 reply; 5+ messages in thread
From: Lars Ingebrigtsen @ 2021-01-27 6:20 UTC (permalink / raw)
To: Nicholas Drozd; +Cc: 43302
[-- Attachment #1: Type: text/plain, Size: 537 bytes --]
Nicholas Drozd <nicholasdrozd@gmail.com> writes:
> In 27, it looks like this:
>
> #+begin_src
> $ bash password.sh
> Password:
> asdf
> $
> #+end_src
>
> The password (=asdf=) gets input directly into the shell buffer, unstarred.
I'm able to reproduce the behaviour in Emacs 27 and 28. However, if you
say this:
echo -n "Password:"
read -sr password
Then Emacs will *** the password in the minibuffer, so comint only
triggers the password-reading behaviour if there's no newline there.
Now, Emacs 26 did handle this... somewhat:
[-- Attachment #2: Type: image/png, Size: 8929 bytes --]
[-- Attachment #3: Type: text/plain, Size: 366 bytes --]
That is, it would include the newline in the prompt.
So... I think basically this works as intended currently: comint only
triggers the password-reading behaviour if the prompt is on the current
line (i.e., without a newline), so I'm closing this bug report.
--
(domestic pets only, the antidote for overdose, milk.)
bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 5+ messages in thread
* bug#43302: password shows up in shell buffer (27.1)
2021-01-27 6:20 ` Lars Ingebrigtsen
@ 2021-02-12 20:50 ` Nicholas Drozd
2021-02-13 7:23 ` Eli Zaretskii
0 siblings, 1 reply; 5+ messages in thread
From: Nicholas Drozd @ 2021-02-12 20:50 UTC (permalink / raw)
To: Lars Ingebrigtsen; +Cc: 43302
Your workaround works, but the fact remains that the behavior changed
between 26 and 27, and it changed in a way that I as a user found
disturbing. I switched to 27, and on my first session I ran a script
that queried for a password. Previously Emacs had hid the password as
I expected, but in 27 my password was unexpectedly exposed on the
screen. It's a bug, and it should be fixed. (I would try to fix it
myself, but I have no idea where to start. With a little guidance I
could take a crack at it.)
Alternatively, it could have been an intentional change in behavior.
In that case it should be noted in NEWS. Something like: "shell-mode:
Passwords are protected in fewer circumstances." But that sounds more
like antinews than news.
On Wed, Jan 27, 2021 at 12:20 AM Lars Ingebrigtsen <larsi@gnus.org> wrote:
>
> Nicholas Drozd <nicholasdrozd@gmail.com> writes:
>
> > In 27, it looks like this:
> >
> > #+begin_src
> > $ bash password.sh
> > Password:
> > asdf
> > $
> > #+end_src
> >
> > The password (=asdf=) gets input directly into the shell buffer, unstarred.
>
> I'm able to reproduce the behaviour in Emacs 27 and 28. However, if you
> say this:
>
> echo -n "Password:"
> read -sr password
>
> Then Emacs will *** the password in the minibuffer, so comint only
> triggers the password-reading behaviour if there's no newline there.
>
> Now, Emacs 26 did handle this... somewhat:
>
>
> That is, it would include the newline in the prompt.
>
> So... I think basically this works as intended currently: comint only
> triggers the password-reading behaviour if the prompt is on the current
> line (i.e., without a newline), so I'm closing this bug report.
>
> --
> (domestic pets only, the antidote for overdose, milk.)
> bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 5+ messages in thread
* bug#43302: password shows up in shell buffer (27.1)
2021-02-12 20:50 ` Nicholas Drozd
@ 2021-02-13 7:23 ` Eli Zaretskii
0 siblings, 0 replies; 5+ messages in thread
From: Eli Zaretskii @ 2021-02-13 7:23 UTC (permalink / raw)
To: Nicholas Drozd; +Cc: larsi, 43302
> From: Nicholas Drozd <nicholasdrozd@gmail.com>
> Date: Fri, 12 Feb 2021 14:50:01 -0600
> Cc: 43302@debbugs.gnu.org
>
> Your workaround works, but the fact remains that the behavior changed
> between 26 and 27, and it changed in a way that I as a user found
> disturbing. I switched to 27, and on my first session I ran a script
> that queried for a password. Previously Emacs had hid the password as
> I expected, but in 27 my password was unexpectedly exposed on the
> screen. It's a bug, and it should be fixed. (I would try to fix it
> myself, but I have no idea where to start. With a little guidance I
> could take a crack at it.)
I'd start at comint-watch-for-password-prompt.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-02-13 7:23 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-10 0:40 bug#43302: password shows up in shell buffer (27.1) Nicholas Drozd
2020-09-10 12:26 ` Robert Pluim
2021-01-27 6:20 ` Lars Ingebrigtsen
2021-02-12 20:50 ` Nicholas Drozd
2021-02-13 7:23 ` Eli Zaretskii
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.