( )⚙ D10708 util: avoid echoing the password to the console on Windows py3 (issue6446)

This is an archive of the discontinued Mercurial Phabricator instance.

Differential D10708

util: avoid echoing the password to the console on Windows py3 (issue6446)
ClosedPublic

Authored by mharbison72 on May 12 2021, 12:43 PM.

Details

Reviewers
None
Group Reviewers
hg-reviewers
Commits
rHG5b3513177f2b: util: avoid echoing the password to the console on Windows py3 (issue6446)
Summary

The getpass.getpass() implementation on Windows first checks if sys.stdin
and sys.__stdin__ are the same object. It's not on py3 because the former is
replaced in dispatch.py with something that doesn't normalize '\n' to '\r\n'.
When they aren't the same object, it simply calls sys.stdin.readline() instead
of the mscvrt functions that read the input characters before they are echoed.

This simply copies the getpass.win_getpass() implementation without the stdin
check, and byteifies around the edges. I'm not sure if there's a reasonable
replacement for the check that we could implement. When echoing input into the
hg command, the ui.interactive() check causes ui.getpass() to bail before
getting here. If the proper config switches are used to bypass that and call
this, the process stalls until '\n' is input into the console. So there could
be a deadlock here when run by another command if the wrong config settings are
applied.

Diff Detail

Repository
rHG Mercurial
Branch
stable
Lint
No Linters Available
Unit
No Unit Test Coverage

Event Timeline

mharbison72 created this revision.May 12 2021, 12:43 PM
mharbison72 added a commit: rHG5b3513177f2b: util: avoid echoing the password to the console on Windows py3 (issue6446).May 14 2021, 3:09 PM
This revision was not accepted when it landed; it landed in state Needs Review.
Closed by commit rHG5b3513177f2b: util: avoid echoing the password to the console on Windows py3 (issue6446) (authored by mharbison72). · Explain Why
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/posix.py (4 lines)
Mmercurial/ui.py (3 lines)
Mmercurial/util.py (1 line)
Mmercurial/windows.py (22 lines)

Diff 27909

mercurial/posix.py

def getfstype(dirpath): def getfstype(dirpath):
"""Get the filesystem type name from a directory (best-effort) """Get the filesystem type name from a directory (best-effort)
Returns None if we are unsure. Raises OSError on ENOENT, EPERM, etc. Returns None if we are unsure. Raises OSError on ENOENT, EPERM, etc.
""" """
return getattr(osutil, 'getfstype', lambda x: None)(dirpath) return getattr(osutil, 'getfstype', lambda x: None)(dirpath)
def get_password():
return encoding.strtolocal(getpass.getpass(''))
def setbinary(fd): def setbinary(fd):
pass pass
def pconvert(path): def pconvert(path):
return path return path

mercurial/ui.py

# ui.py - user interface bits for mercurial # ui.py - user interface bits for mercurial
# #
# Copyright 2005-2007 Olivia Mackall <olivia@selenic.com> # Copyright 2005-2007 Olivia Mackall <olivia@selenic.com>
# #
# This software may be used and distributed according to the terms of the # This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version. # GNU General Public License version 2 or any later version.
from __future__ import absolute_import from __future__ import absolute_import
import collections import collections
import contextlib import contextlib
import datetime import datetime
import errno import errno
import getpass
import inspect import inspect
import os import os
import re import re
import signal import signal
import socket import socket
import subprocess import subprocess
import sys import sys
import traceback import traceback
# to interact with tty even if fin is not a tty. # to interact with tty even if fin is not a tty.
with self.timeblockedsection(b'stdio'): with self.timeblockedsection(b'stdio'):
if self.configbool(b'ui', b'nontty'): if self.configbool(b'ui', b'nontty'):
l = self._fin.readline() l = self._fin.readline()
if not l: if not l:
raise EOFError raise EOFError
return l.rstrip(b'\n') return l.rstrip(b'\n')
else: else:
return encoding.strtolocal(getpass.getpass('')) return util.get_password()
except EOFError: except EOFError:
raise error.ResponseExpected() raise error.ResponseExpected()
def status(self, *msg, **opts): def status(self, *msg, **opts):
"""write status message to output (if ui.quiet is False) """write status message to output (if ui.quiet is False)
This adds an output label of "ui.status". This adds an output label of "ui.status".
""" """

mercurial/util.py

bindunixsocket = platform.bindunixsocket bindunixsocket = platform.bindunixsocket
cachestat = platform.cachestat cachestat = platform.cachestat
checkexec = platform.checkexec checkexec = platform.checkexec
checklink = platform.checklink checklink = platform.checklink
copymode = platform.copymode copymode = platform.copymode
expandglobs = platform.expandglobs expandglobs = platform.expandglobs
getfsmountpoint = platform.getfsmountpoint getfsmountpoint = platform.getfsmountpoint
getfstype = platform.getfstype getfstype = platform.getfstype
get_password = platform.get_password
groupmembers = platform.groupmembers groupmembers = platform.groupmembers
groupname = platform.groupname groupname = platform.groupname
isexec = platform.isexec isexec = platform.isexec
isowner = platform.isowner isowner = platform.isowner
listdir = osutil.listdir listdir = osutil.listdir
localpath = platform.localpath localpath = platform.localpath
lookupreg = platform.lookupreg lookupreg = platform.lookupreg
makedir = platform.makedir makedir = platform.makedir

mercurial/windows.py

# copied from .utils.procutil, remove after Python 2 support was dropped # copied from .utils.procutil, remove after Python 2 support was dropped
def _isatty(fp): def _isatty(fp):
try: try:
return fp.isatty() return fp.isatty()
except AttributeError: except AttributeError:
return False return False
def get_password():
"""Prompt for password with echo off, using Windows getch().
This shouldn't be called directly- use ``ui.getpass()`` instead, which
checks if the session is interactive first.
"""
pw = ""
while True:
c = msvcrt.getwch()
if c == '\r' or c == '\n':
break
if c == '\003':
raise KeyboardInterrupt
if c == '\b':
pw = pw[:-1]
else:
pw = pw + c
msvcrt.putwch('\r')
msvcrt.putwch('\n')
return encoding.strtolocal(pw)
class winstdout(object): class winstdout(object):
"""Some files on Windows misbehave. """Some files on Windows misbehave.
When writing to a broken pipe, EINVAL instead of EPIPE may be raised. When writing to a broken pipe, EINVAL instead of EPIPE may be raised.
When writing too many bytes to a console at the same, a "Not enough space" When writing too many bytes to a console at the same, a "Not enough space"
error may happen. Python 3 already works around that. error may happen. Python 3 already works around that.
""" """