changeset 47079:5b3513177f2b stable

util: avoid echoing the password to the console on Windows py3 (issue6446) The `getpass.getpass()` implementation on Windows first checks if `sys.stdin` and `sys.__stdin__` are the same object. It's not on py3 because the former is replaced in dispatch.py with something that doesn't normalize '\n' to '\r\n'. When they aren't the same object, it simply calls `sys.stdin.readline()` instead of the mscvrt functions that read the input characters before they are echoed. This simply copies the `getpass.win_getpass()` implementation without the stdin check, and byteifies around the edges. I'm not sure if there's a reasonable replacement for the check that we could implement. When echoing input into the hg command, the `ui.interactive()` check causes `ui.getpass()` to bail before getting here. If the proper config switches are used to bypass that and call this, the process stalls until '\n' is input into the console. So there could be a deadlock here when run by another command if the wrong config settings are applied. Differential Revision: https://phab.mercurial-scm.org/D10708
author Matt Harbison <matt_harbison@yahoo.com>
date Wed, 12 May 2021 12:41:52 -0400
parents 3af293735d0f
children 94c0c36299b1
files mercurial/posix.py mercurial/ui.py mercurial/util.py mercurial/windows.py
diffstat 4 files changed, 28 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/mercurial/posix.py	Mon May 10 00:54:08 2021 +0000
+++ b/mercurial/posix.py	Wed May 12 12:41:52 2021 -0400
@@ -381,6 +381,10 @@
     return getattr(osutil, 'getfstype', lambda x: None)(dirpath)
 
 
+def get_password():
+    return encoding.strtolocal(getpass.getpass(''))
+
+
 def setbinary(fd):
     pass
 
--- a/mercurial/ui.py	Mon May 10 00:54:08 2021 +0000
+++ b/mercurial/ui.py	Wed May 12 12:41:52 2021 -0400
@@ -11,7 +11,6 @@
 import contextlib
 import datetime
 import errno
-import getpass
 import inspect
 import os
 import re
@@ -1779,7 +1778,7 @@
                         raise EOFError
                     return l.rstrip(b'\n')
                 else:
-                    return encoding.strtolocal(getpass.getpass(''))
+                    return util.get_password()
         except EOFError:
             raise error.ResponseExpected()
 
--- a/mercurial/util.py	Mon May 10 00:54:08 2021 +0000
+++ b/mercurial/util.py	Wed May 12 12:41:52 2021 -0400
@@ -106,6 +106,7 @@
 expandglobs = platform.expandglobs
 getfsmountpoint = platform.getfsmountpoint
 getfstype = platform.getfstype
+get_password = platform.get_password
 groupmembers = platform.groupmembers
 groupname = platform.groupname
 isexec = platform.isexec
--- a/mercurial/windows.py	Mon May 10 00:54:08 2021 +0000
+++ b/mercurial/windows.py	Wed May 12 12:41:52 2021 -0400
@@ -194,6 +194,28 @@
         return False
 
 
+def get_password():
+    """Prompt for password with echo off, using Windows getch().
+
+    This shouldn't be called directly- use ``ui.getpass()`` instead, which
+    checks if the session is interactive first.
+    """
+    pw = ""
+    while True:
+        c = msvcrt.getwch()
+        if c == '\r' or c == '\n':
+            break
+        if c == '\003':
+            raise KeyboardInterrupt
+        if c == '\b':
+            pw = pw[:-1]
+        else:
+            pw = pw + c
+    msvcrt.putwch('\r')
+    msvcrt.putwch('\n')
+    return encoding.strtolocal(pw)
+
+
 class winstdout(object):
     """Some files on Windows misbehave.