search

jdx / demand

prompt library for rust
https://docs.rs/demand
MIT License
52 stars 3 forks source link

[security] password input renders password on success #59

Closed rendarz closed 3 months ago

rendarz commented 3 months ago

Consider this very simple code:

let input = demand::Input::new("Password:")
  .inline(true)
  .prompt("")
  .password(true);
let name = input.run().expect("error running input");

It lets me to input a password, and the password characters are indeed hidden by * characters. But when I press enter, the password is written in stdout IN CLEAR, like if its a normal input entry. Why? Am I missing something, or doing something wrong? IMHO, the flag .password(true) should absolutely block this, or it could generate UNWANTED SURPRISES! NOTE: It works like that even with .inline(false).

2 1

roele commented 3 months ago

@rendarz Indeed a valid concern! Thanks for reporting this.