fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(audit-2026-06-11/H2): reject inline CLI secrets; true no-echo prompt

Browse Source 
pic admins create/set --password and pic login --token accepted secrets
on argv, where they leak into shell history, ps aux, and
/proc/<pid>/cmdline. Now only --password -/--token - (stdin) is allowed;
an inline value is rejected with guidance. PICLOUD_TOKEN env still covers
CI for login.

Also (M2): the interactive admins password prompt used read_line, which
echoes despite a 'no echo' claim — switched to rpassword::prompt_password
(already a dep via login). Removed the now-dead ReadLine trait + Write
import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-12 18:34:45 +02:00
parent 3ac1022c33
commit bdcc9a606d
4 changed files with 75 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
crates/picloud-cli/src/main.rs
View File

@@ -119,9 +119,10 @@ struct LoginArgs {
#[arg(long)]
url: Option<String>,
/// Skip the username + password exchange and persist this bearer
/// directly (validated against `/auth/me` first). Also reads
/// `PICLOUD_TOKEN`.
/// Skip the username + password exchange and persist a bearer
/// directly (validated against `/auth/me` first). Pass `--token -`
/// to read it from stdin; an inline value is rejected (it leaks into
/// shell history / `ps`). For CI, set `PICLOUD_TOKEN` instead.
#[arg(long)]
token: Option<String>,
}
@@ -551,9 +552,9 @@ enum AdminsCmd {
/// `--instance-role`, defaults to `admin`.
Create {
username: String,
/// Password. `-` reads from stdin (one line interactive, or the
/// full input piped). Passing the password inline puts it in
/// shell history — pipe instead when scripting.
/// Password. Use `--password -` to read from stdin (interactive
/// no-echo prompt, or piped). An inline value is rejected — it
/// would leak into shell history, `ps`, and /proc.
#[arg(long)]
password: Option<String>,
/// `owner`, `admin`, or `member`. Defaults to `admin`.
@@ -571,7 +572,8 @@ enum AdminsCmd {
id: String,
#[arg(long)]
username: Option<String>,
/// `-` reads from stdin. Inline value lands in shell history.
/// Use `--password -` to read from stdin. An inline value is
/// rejected (it leaks into shell history, `ps`, and /proc).
#[arg(long)]
password: Option<String>,
/// `true` to (re)activate, `false` to deactivate (deactivation