[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: master 3df7d06: Added `comint-password-function' hook

From: Eli Zaretskii
Subject: Re: master 3df7d06: Added `comint-password-function' hook
Date: Mon, 23 Dec 2019 16:01:49 +0200

> From: Michael Albinus <address@hidden>
> Date: Mon, 23 Dec 2019 11:24:56 +0100
> Cc: "Michael R. Mauger" <address@hidden>
> > +*** Abnormal hook `comint-password-function' has been added.
> > +This hook permits a derived mode to supply a password for the
> > +underlying command interpreter without prompting the user.  For
> > +example, in sql-mode, the password for connecting to the database may
> > +be stored in the connection wallet and may be passed on the command
> > +line to start the SQL interpreter.  This is a potential security flaw
> > +that could expose user's database passwords on the command line
> > +through the use of a process list (Bug#8427).  With this hook, it is
> > +possible to not pass the password on the command line and wait for the
> > +program to prompt for the password.  When it does so, the password cam
> > +be supplied to the SQL interpreter without involving the user just as
> > +if it had been supplied on the command line.
> Shouldn't this be documented in the manual, or at least in the
> docstring?

It should.

> Furthermore, we don't mention bug numbers in etc/NEWS.


Patches with corrections are welcome.  Thanks.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]