GNU bug report logs - #5664
view-lossage may show passwords and sensitive information

Previous Next

Full log

Message #25 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Thierry Volpiatto <thierry.volpiatto <at> gmail.com>
To: bug-gnu-emacs <at> gnu.org
Subject: Re: bug#5664: 23.1.92; view-lossage
Date: Sun, 07 Mar 2010 14:39:46 +0100

Andreas Roehler <andreas.roehler <at> online.de> writes:

> Chong Yidong wrote:
>> Andreas Roehler <andreas.roehler <at> online.de> writes:
>> 
>>> emacs -q
>>> M-x shell
>>> /bin/su at shell prompt
>>>
>>> prompt for PW arrives, when PW putted in, its visible at the screen
>>>
>>> root-shell (bash) arrives
>>>
>>> M-x report-emacs-bug
>>>
>>> View lossage displays root-password, replaced for this report by
>>> MY-PW-SHOWN-HERE
>> 
>> I'm afraid I can't reproduce this.  One possibility is that you are
>> using a locale where the password prompt is given in a language that
>> comint-watch-for-password-prompt does not recognize.  This is a known
>> issue; customize comint-password-prompt-regexp to add the
>> locale-dependent password prompt(s) to the list of recognized prompts.
>> 
>
> Thanks, that helps here.
> However, think there is a bug though. If Emacs is able to display the prompt delivered,
> it should adapt its behavior independently from the regexp already customized.

As Chong said you must use a non--english/us locale.
I have the same problem here, my prompt is not "Password" but "Mot de
Passe", due to my french locale.
All the prompts for password (e.g su/sudo) in the emacs shell use a
cryptic regex.
Setting it is a pain, i always have undesired side effects trying to set
them. (shell and eshell).

For shell (don't work in eshell):
A workaround for "su" is creating an alias in bashrc:

alias su="LC_ALL=C su -l"

For sudo:
alias sudo="sudo -p Password: "

For eshell i didn't find good solution appart putting in my .emacs:

(setenv "LC_ALL" "C")

Work fine but may create other encoding problems in others places.

The best thing should be that all emacs shell don't obey to locale
setting for password prompt, i thing the word "password" in
international well known.
  
-- 
Thierry Volpiatto
Gpg key: http://pgp.mit.edu/

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.