GNU bug report logs - #20910
24.4; *shell* write the password in clear in the buffer on git push

Previous Next

Full log

Message #26 received at 20910-done <at> debbugs.gnu.org (full text, mbox):

From: Stefan Kangas <stefan <at> marxist.se>
To: Marcin Borkowski <mbork <at> amu.edu.pl>
Cc: 20910-done <at> debbugs.gnu.org, aurelien <aurelien <at> hackers.camp>,
 Stefan Monnier <monnier <at> iro.umontreal.ca>
Subject: Re: bug#20910: 24.4; *shell* write the password in clear in the
 buffer on git push
Date: Thu, 07 Nov 2019 01:49:47 +0100

Stefan Kangas <stefan <at> marxist.se> writes:

>>>> M-x shell
>>>> git add mysupersoftware.py
>>>> git commit -m "pay attention of the pep8 thanks M-x py-pep8-run"
>>>> git push
>>>> shell $ request for the password of the git, and print it in clear in
>>>> the buffer
>>>
>>> Can you show us the actual password prompt (which is the only info that
>>> Emacs gets that a password is being requested, so it needs to recognize
>>> it, and those prompts change with language settings and stuff, so it's
>>> very heuristic and messy).
>>
>> I suspect that this might depend on Git version and configuration, and
>> things like gpg-agent.  In my case, it displayed a window (in WM sense,
>> not in Emacs sense) asking for password, and only after clicking
>> "Cancel", it asked within Emacs.  The prompt was:
>>
>> Password for 'https://mbork <at> github.com':
>>
>> and indeed the characters of the password were visible.
>>
>>>         Stefan
>>
>> Best,
>
> Hi Marcin,
>
> When I try the following on Emacs 26.1, I get no error:
>
> (progn
>  (require 'comint)
>  (or
>   (string-match comint-password-prompt-regexp
>        "Password for 'https://foo <at> example.org: ")
>   (error "NO MATCH")))
>
> This suggests to me that a prompt such as the above should work under
> M-x shell, since that is built on top of comint.
>
> Could you verify that this works for you on Emacs 26.1 or later?

More information was requested, but none was given within 4 weeks.

I went ahead and added a string to test for the above to the test
suite in commit 1428dfe630, and with that I'm closing this bug.

Best regards,
Stefan Kangas

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.