bug#8427: Fwd: bug#8427: [SECURITY] sql.el -- comint process passwords are leaked to ps(1) listing

[Stefan Kangas]

---------- Forwarded message ---------
From: Andrew Hyatt <ahyatt@gmail.com>
Date: lör 19 okt. 2019 kl 04:07
Subject: Re: bug#8427: [SECURITY] sql.el -- comint process passwords
are leaked to ps(1) listing
To: Stefan Kangas <stefan@marxist.se>

I'm attaching the fix.  The fix for MySQL was fairly straightforward.  I
tried it out, and it works.  I looked through sql.el for similar issues,
and was able to fix Vertica as well, although I've never heard of
Vertica before and couldn't test it out.  Parameters were set according
to the docs at
https://www.vertica.com/docs/9.2.x/HTML/Content/Authoring/ConnectingToVertica/vsql/CommandLineOptions.htm,
which does match the existing code.

If this looks good to you, I will submit it (I have commit access).


Stefan Kangas <stefan@marxist.se> writes:

> Andrew Hyatt <ahyatt@gmail.com> writes:
>
>>> Could you perhaps send your patch here for review?
>>
>> I no longer know where my changes are.   It's been a while.  But I think I 
>> can probably recreate them, which I'll try to do this week.
> [...]
>> The idea is that instead of connecting with the --password arg, it can be 
>> left out entirely, in which case the program should ask for it (which is 
>> secure).
>
> Sounds good, thanks.
>
> Best regards,
> Stefan Kangas

0001-Enable-password-less-connections-for-sql-where-possi.patch
Description: Source code patch