Bug 2232317

Summary:	gnome-terminal echos sensitive commands
Product:	[Fedora] Fedora	Reporter:	zorrodino
Component:	gnome-terminal	Assignee:	Matthias Clasen <mclasen>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	37	CC:	amigadave, gnome-sig, mclasen, philip.wyett, rstrode
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description zorrodino 2023-08-16 09:44:39 UTC

Gnome terminal echos the command being executed in the tab/terminal title regardless of the settings.

This is a problem for me because occasionally I run scrips which require a password as an argument.
For example: az login -u .... -p #####
I start these commands with the HISTIGNORE value of course.

The problem is that this behaviour appears inescapable.
Changes to PROMPT_COMMAND and PS1 do not seem to achieve anything.
Changes in settings do not seem to achieve anything.

The problem persists when using bash --norc.

Reproducible: Always

Steps to Reproduce:
1. Open gnome-terminal
2. Run: yes "mypassword"
3. See yes mypassword in terminal title and tab title
Actual Results:  
See yes mypassword in terminal title and tab title

Expected Results:  
Ability to hide sensitive commands

Comment 1 zorrodino 2023-08-16 09:48:44 UTC

The reason I made this a medium bug is that one can work-around the problem. It is, however, very annoying and a security concern if somebody isn't well aware of this.

Setting the command to know what the terminal is running is not bad per-se, BUT there should be some better way to protect sensitive commands