Console history may leak user info about nebula-console HOT 8 CLOSED

Yes, it may leak user info. What's the behavior of other shells?

Other shells? Do you mean that nebula-console behave different in different shell?
Does it rely on any function of shells?

I'll try zsh and on windows powershell/cmd and give a report if you think it's necessary.

from nebula-console.

Yes, it may leak user info.
What's the behavior of other shells?

from nebula-console.

Yes, I wonder what the behaviour of zsh,bash and other database's console

from nebula-console.

Yes, I wonder what the behaviour of zsh,bash and other database's console

Tested, zsh's behavior is the same as bash's.

from nebula-console.

Yes, it may leak user info. What's the behavior of other shells?

Other shells? Do you mean that nebula-console behave different in different shell? Does it rely on any function of shells?

I'll try zsh and on windows powershell/cmd and give a report if you think it's necessary.

Sorry, I didn't make it clear. Actually, I want to know what is the difference between nebula-console and other databases console or other shells in recording historical commands that contain passwords.

from nebula-console.

1. nebula-console;
2. other database's console: MySQL, neo4j's console;
3. linux shell: bash, zsh;

from nebula-console.

• other database's console: MySQL, neo4j's console;

Get it.

1. "nebula-console" will show history (include command with password) to any user loged in.
2. Mysql will filter out user create command. Maybe we should consider more command that may leak info(username, password, table/graph name, etc.)
3. Both linux shell will only show history of current users' past login, most password is asked after command and will not record, some inline password will leak from current user's history, while users can manually remove it.

Neo4j not deployed now, will try that later.

from nebula-console.

As we save the history in file, user can read the password in file directly.
same behavior with mycli.

from nebula-console.