Repository navigation
Avoid exposing secure argument values to STDOUT when using --prompt #5568
Description
Activity
Thanks for the report, @WilliamDEdwards !
I can confirm the behavior you're describing:
$ wp core config --prompt 1/14 --dbname=<dbname>: dbtest 2/14 --dbuser=<dbuser>: dbtest 3/14 [--dbpass=<dbpass>]: dbtest 4/14 [--dbhost=<dbhost>]: 5/14 [--dbprefix=<dbprefix>]: 6/14 [--dbcharset=<dbcharset>]: 7/14 [--dbcollate=<dbcollate>]: 8/14 [--locale=<locale>]: 9/14 [--extra-php] (Y/n): 10/14 [--skip-salts] (Y/n): 11/14 [--skip-check] (Y/n): 12/14 [--force] (Y/n): 13/14 [--config-file=<path>]: 14/14 [--insecure] (Y/n): wp config create --dbname='dbtest' --dbuser='dbtest' --dbpass='dbtest' --dbhost='localhost' --dbprefix='wp_' --dbcharset='utf8' --dbcollate='' ERROR 1045 (28000): Access denied for user 'dbtest'@'localhost' (using password: YES)It looks like this behavior was added with #5322 for #4995
The original "secure" implementation of
--promptwas #3531, and you can see the history here: #129In this case, I think we should automatically obscure the "secure" arguments we don't want to display (no additional flag). We can improve our argument options API to support a
secureattribute:diff --git a/src/Config_Command.php b/src/Config_Command.php index 70073d70..5bc107d0 100644 --- a/src/Config_Command.php +++ b/src/Config_Command.php @@ -65,6 +65,9 @@ class Config_Command extends WP_CLI_Command { * * [--dbpass=<dbpass>] * : Set the database user password. + * --- + * secure: true + * --- * * [--dbhost=<dbhost>] * : Set the database host.If
secure=true, then the value should be obscured in STDOUT.- changed the title
[-]Avoid --prompt input to stdout[/-][+]Avoid exposing secure argument values to STDOUT when using --prompt[/+]on Nov 9, 2022
--promptis a global parameter that allows for passing input to stdin, instead of specifying it on the CLI. This is useful for passing confidential information, such as passwords (documented as a common use case @ https://developer.wordpress.org/cli/commands/config/create/#examples).In case of an error, WP-CLI outputs the full command it runs to stdout. When using
--prompt, WP-CLI runs a different command than the user-specified one, as the parameters and arguments specified in--promptare added to the cmdline.When using
--prompt=dbpass, the stdin value ofdbpass(--dbpass='test') is echoed to stdout:This defeats the purpose of using
--promptfor security, as stdout may end up in logs and user terminals.I think it would be useful to hide parameters/arguments specified using
--promptfrom the cmdline in stdout.P.S. I'm aware that
--quietsuppresses stdout output, but having stdout can be useful for debugging.