chocolatey / ChocolateyGUI

A delicious GUI for Chocolatey
https://docs.chocolatey.org/en-us/chocolatey-gui/
Apache License 2.0
1.61k stars 249 forks source link

Remember arguments showing too much information #1000

Closed pauby closed 1 year ago

pauby commented 1 year ago

What You Are Seeing?

When passing --user and --password options to Chocolatey CLI, the parameters can be seen when viewing the arguments in Chocolatey GUI.

What is Expected?

When passing sensitive inputs through Chocolatey CLI, users should not be able to see those arguments by viewing the package arguments in the GUI.

How Did You Get This To Happen? (Steps to Reproduce)

  1. Install Chocolatey (Version 1.4.0 was used for replication)
  2. Install Chocolatey GUI choco install chocolateygui --confirm
  3. Enable remembered arguments for upgrades choco feature enable --name='useRememberedArgumentsForUpgrades'
  4. Install something else with [Source] (optional) / Username / Password choco install nexushell --User bob --Password "bill"
  5. Click into the package within Chocolatey GUI and click View Package Arguments, see the options in plain text

System Details

Related Issues