util: avoid echoing the password to the console on Windows py3 (issue6446) stable

util: avoid echoing the password to the console on Windows py3 (issue6446)

The `getpass.getpass()` implementation on Windows first checks if `sys.stdin`
and `sys.__stdin__` are the same object.  It's not on py3 because the former is
replaced in dispatch.py with something that doesn't normalize '\n' to '\r\n'.
When they aren't the same object, it simply calls `sys.stdin.readline()` instead
of the mscvrt functions that read the input characters before they are echoed.

This simply copies the `getpass.win_getpass()` implementation without the stdin
check, and byteifies around the edges.  I'm not sure if there's a reasonable
replacement for the check that we could implement.  When echoing input into the
hg command, the `ui.interactive()` check causes `ui.getpass()` to bail before
getting here.  If the proper config switches are used to bypass that and call
this, the process stalls until '\n' is input into the console.  So there could
be a deadlock here when run by another command if the wrong config settings are
applied.

Differential Revision: https://phab.mercurial-scm.org/D10708

--- a/mercurial/posix.py	Mon May 10 00:54:08 2021 +0000
+++ b/mercurial/posix.py	Wed May 12 12:41:52 2021 -0400
@@ -381,6 +381,10 @@
     return getattr(osutil, 'getfstype', lambda x: None)(dirpath)
 
 
+def get_password():
+    return encoding.strtolocal(getpass.getpass(''))
+
+
 def setbinary(fd):
     pass
 

--- a/mercurial/ui.py	Mon May 10 00:54:08 2021 +0000
+++ b/mercurial/ui.py	Wed May 12 12:41:52 2021 -0400
@@ -11,7 +11,6 @@
 import contextlib
 import datetime
 import errno
-import getpass
 import inspect
 import os
 import re
@@ -1779,7 +1778,7 @@
                         raise EOFError
                     return l.rstrip(b'\n')
                 else:
-                    return encoding.strtolocal(getpass.getpass(''))
+                    return util.get_password()
         except EOFError:
             raise error.ResponseExpected()
 

--- a/mercurial/util.py	Mon May 10 00:54:08 2021 +0000
+++ b/mercurial/util.py	Wed May 12 12:41:52 2021 -0400
@@ -106,6 +106,7 @@
 expandglobs = platform.expandglobs
 getfsmountpoint = platform.getfsmountpoint
 getfstype = platform.getfstype
+get_password = platform.get_password
 groupmembers = platform.groupmembers
 groupname = platform.groupname
 isexec = platform.isexec

--- a/mercurial/windows.py	Mon May 10 00:54:08 2021 +0000
+++ b/mercurial/windows.py	Wed May 12 12:41:52 2021 -0400
@@ -194,6 +194,28 @@
         return False
 
 
+def get_password():
+    """Prompt for password with echo off, using Windows getch().
+
+    This shouldn't be called directly- use ``ui.getpass()`` instead, which
+    checks if the session is interactive first.
+    """
+    pw = ""
+    while True:
+        c = msvcrt.getwch()
+        if c == '\r' or c == '\n':
+            break
+        if c == '\003':
+            raise KeyboardInterrupt
+        if c == '\b':
+            pw = pw[:-1]
+        else:
+            pw = pw + c
+    msvcrt.putwch('\r')
+    msvcrt.putwch('\n')
+    return encoding.strtolocal(pw)
+
+
 class winstdout(object):
     """Some files on Windows misbehave.