[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: master 3df7d06: Added `comint-password-function' hook

From: Michael Albinus
Subject: Re: master 3df7d06: Added `comint-password-function' hook
Date: Mon, 23 Dec 2019 11:24:56 +0100
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux)

mmaug--- via Mailing list for Emacs changes <address@hidden>

Hi Michael,

> --- a/etc/NEWS
> +++ b/etc/NEWS
> @@ -1131,6 +1131,19 @@ end.
>  *** 'comint-run' can now accept a list of switches to pass to the program.
>  'C-u M-x comint-run' will prompt for the switches interactively.
> +*** Abnormal hook `comint-password-function' has been added.
> +This hook permits a derived mode to supply a password for the
> +underlying command interpreter without prompting the user.  For
> +example, in sql-mode, the password for connecting to the database may
> +be stored in the connection wallet and may be passed on the command
> +line to start the SQL interpreter.  This is a potential security flaw
> +that could expose user's database passwords on the command line
> +through the use of a process list (Bug#8427).  With this hook, it is
> +possible to not pass the password on the command line and wait for the
> +program to prompt for the password.  When it does so, the password cam
> +be supplied to the SQL interpreter without involving the user just as
> +if it had been supplied on the command line.

Shouldn't this be documented in the manual, or at least in the
docstring? etc/NEWS is not the preferred place to look for
documentation, except when a new Emacs release arrives.

Furthermore, we don't mention bug numbers in etc/NEWS.

Best regards, Michael.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]