From 59ad7300ecb726843f6452b42807882d89ee50d1 Mon Sep 17 00:00:00 2001 From: Valera Cogut Date: Wed, 21 Nov 2018 15:49:36 +0200 Subject: [PATCH 1/3] Safer way to handle secret information of cli_wallet #1171 --- src/rpc/cli.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/rpc/cli.cpp b/src/rpc/cli.cpp index 7f324dc65..672383d6e 100644 --- a/src/rpc/cli.cpp +++ b/src/rpc/cli.cpp @@ -327,6 +327,15 @@ void cli::getline( const std::string& prompt, std::string& line) line = line_read; // we don't need here to add line in editline's history, cause it will be doubled free(line_read); + if (cli_check_secret(line_read)) { + el_no_echo = 1; + line_read = readline("Enter password: "); + el_no_echo = 0; + if( line_read == nullptr ) + FC_THROW_EXCEPTION( fc::eof_exception, "" ); + line = line + ' ' + line_read; + } + free(line_read); }).wait(); } } From 73ae27e0b88d7f7a3c18fc860669bbd58bcfdbc2 Mon Sep 17 00:00:00 2001 From: Valera Cogut Date: Sun, 2 Jun 2019 11:31:41 +0300 Subject: [PATCH 2/3] Added little improvements: free line_read before re-using it & check for nullptr read_line before using it --- src/rpc/cli.cpp | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/src/rpc/cli.cpp b/src/rpc/cli.cpp index 672383d6e..3531461bd 100644 --- a/src/rpc/cli.cpp +++ b/src/rpc/cli.cpp @@ -316,6 +316,7 @@ void cli::getline( const std::string& prompt, std::string& line) if( _isatty( _fileno( stdin ) ) ) #endif { +<<<<<<< HEAD if( _getline_thread ) { _getline_thread->async( [&prompt,&line](){ @@ -338,6 +339,31 @@ void cli::getline( const std::string& prompt, std::string& line) free(line_read); }).wait(); } +======= + rl_set_complete_func(my_rl_complete); + rl_set_list_possib_func(cli_completion); + + static fc::thread getline_thread("getline"); + getline_thread.async( [&](){ + char* line_read = nullptr; + std::cout.flush(); //readline doesn't use cin, so we must manually flush _out + line_read = readline(prompt.c_str()); + if( line_read == nullptr ) + FC_THROW_EXCEPTION( fc::eof_exception, "" ); + line = line_read; + // we don't need here to add line in editline's history, cause it will be doubled + free(line_read); + if (cli_check_secret(line_read)) { + el_no_echo = 1; + line_read = readline("Enter password: "); + if( line_read == nullptr ) + FC_THROW_EXCEPTION( fc::eof_exception, "" ); + el_no_echo = 0; + line = line + ' ' + line_read; + } + free(line_read); + }).wait(); +>>>>>>> Added little improvements: free line_read before re-using it & check for nullptr read_line before using it } else #endif From 720805493fdf697c121cb225b5f013deb5210a99 Mon Sep 17 00:00:00 2001 From: Valera Cogut Date: Sun, 2 Jun 2019 12:39:27 +0300 Subject: [PATCH 3/3] Fixed conflicts & rebased --- src/rpc/cli.cpp | 28 +--------------------------- 1 file changed, 1 insertion(+), 27 deletions(-) diff --git a/src/rpc/cli.cpp b/src/rpc/cli.cpp index 3531461bd..7694e2fe7 100644 --- a/src/rpc/cli.cpp +++ b/src/rpc/cli.cpp @@ -316,7 +316,6 @@ void cli::getline( const std::string& prompt, std::string& line) if( _isatty( _fileno( stdin ) ) ) #endif { -<<<<<<< HEAD if( _getline_thread ) { _getline_thread->async( [&prompt,&line](){ @@ -327,8 +326,8 @@ void cli::getline( const std::string& prompt, std::string& line) FC_THROW_EXCEPTION( fc::eof_exception, "" ); line = line_read; // we don't need here to add line in editline's history, cause it will be doubled - free(line_read); if (cli_check_secret(line_read)) { + free(line_read); el_no_echo = 1; line_read = readline("Enter password: "); el_no_echo = 0; @@ -339,31 +338,6 @@ void cli::getline( const std::string& prompt, std::string& line) free(line_read); }).wait(); } -======= - rl_set_complete_func(my_rl_complete); - rl_set_list_possib_func(cli_completion); - - static fc::thread getline_thread("getline"); - getline_thread.async( [&](){ - char* line_read = nullptr; - std::cout.flush(); //readline doesn't use cin, so we must manually flush _out - line_read = readline(prompt.c_str()); - if( line_read == nullptr ) - FC_THROW_EXCEPTION( fc::eof_exception, "" ); - line = line_read; - // we don't need here to add line in editline's history, cause it will be doubled - free(line_read); - if (cli_check_secret(line_read)) { - el_no_echo = 1; - line_read = readline("Enter password: "); - if( line_read == nullptr ) - FC_THROW_EXCEPTION( fc::eof_exception, "" ); - el_no_echo = 0; - line = line + ' ' + line_read; - } - free(line_read); - }).wait(); ->>>>>>> Added little improvements: free line_read before re-using it & check for nullptr read_line before using it } else #endif