hanslub42/rlwrap

What's the intended way to recognize password prompts ending with a newline?

Closed this issue · 2 comments

The password prompt for the Discworld MUD telnet server looks like this:

Enter your password:
|

where | represents the cursor. Ideally with rlwrap, this next input should get masked with **** if I pass -a'Enter your password:\n' or something. But it seems that newlines don't work with -a -- my password still shows non-****ified.

I thought about writing a filter, but looking at rlwrapfilter.py we have some code preventing this exact case:

response = when_defined(self.prompt_handler, message)
if (re.search('\n', response)):
    send_error('prompts may not contain newlines!')

How should rlwrap recognize this prompt?

The assumption a prompt is some non-empty text that doesn't end with a newline is deeply hard-wired into rlwrap. From rlwraps point of view, your MUD doesn't present any prompt at all. That said:

.. if this is only about not saving the password in your history, you could enter the password with CTRL+O. From the manual:

Control + O
Accept the current line, but don't put it in the history list. This action has a readline command name rlwrap-accept-line-and-forget

Alternatively, you could choose a password like forget_me_MyReAlPaSsWoRd and then call rlwrap --forget_matching forget_me telnet ...

If you are really worried about people looking over your shoulder, you could write a filter. Filters are rlwraps way of providing for corner cases like this one, without adding a myriad options that would complicate the progam's already Byzantine inner workings. In your case, the filter should

  • keep track of the last output line
  • when this equals "Enter your password: "
    • turn off echo on its standard input (which it shares with rlwrap)
    • put an empty string (or some other placeholder) in your history list
  • turn on echo after accepting the input line

In almost any situation, I would be more worried about keeping the password out of history than about making it unreadable on-screen, but your use case may be very different.

Thanks for the detailed reply! This answers my question, closing!