TTY detection and handling

[str4d]

• Prevent encrypted output from being sent to stdout if it is bound to a TTY.
• Prevent long or unprintable decrypted output from being sent to stdout if it is bound to a TTY.
• Require a TTY when using the --passphrase / -p flag.
• Turn off TTY echo while reading the passphrase (where possible).

[str4d]

age currently opens /dev/tty for passphrase querying. I think we should do the same on Unix, and then continue to require using -i/--input on Windows when using a passphrase.

[str4d]

Oh, turns out that the console crate used by dialoguer::PasswordInput already opens /dev/tty on Unix by default, and returns an empty string if the terminal is not a TTY. So all we have to do is allow using a pipe input on Unix, and we are done!

[str4d]

Hmm, turns out it isn't that simple. The expected diff would be:

diff --git a/src/bin/rage/error.rs b/src/bin/rage/error.rs
index c9d8dca..bf5b758 100644
--- a/src/bin/rage/error.rs
+++ b/src/bin/rage/error.rs
@@ -48,6 +48,7 @@ pub(crate) enum DecryptError {
     Io(io::Error),
     MissingIdentities(String),
     MixedIdentityAndPassphrase,
+    #[cfg(not(unix))]
     PassphraseWithoutFileArgument,
     RecipientFlag,
     UnsupportedKey(String, age::keys::UnsupportedKey),
@@ -89,6 +90,7 @@ impl fmt::Display for DecryptError {
             DecryptError::MixedIdentityAndPassphrase => {
                 write!(f, "-i/--identity can't be used with -p/--passphrase")
             }
+            #[cfg(not(unix))]
             DecryptError::PassphraseWithoutFileArgument => write!(
                 f,
                 "File to decrypt must be passed as an argument when using -p/--passphrase"
diff --git a/src/bin/rage/main.rs b/src/bin/rage/main.rs
index 130f9d6..164b097 100644
--- a/src/bin/rage/main.rs
+++ b/src/bin/rage/main.rs
@@ -267,8 +267,13 @@ fn decrypt(opts: AgeOptions) -> Result<(), error::DecryptError> {
             return Err(error::DecryptError::MixedIdentityAndPassphrase);
         }
 
-        if opts.input.is_none() {
-            return Err(error::DecryptError::PassphraseWithoutFileArgument);
+        // The `console` crate used by `dialoguer::PasswordInput` opens `/dev/tty`
+        // directly on Unix, so we don't have any conflict with stdin.
+        #[cfg(not(unix))]
+        {
+            if opts.input.is_none() {
+                return Err(error::DecryptError::PassphraseWithoutFileArgument);
+            }
         }
 
         match read_secret("Type passphrase", None) {

But with this, running cat test.age | cargo run -- -d -p in bash results in no output, and a corrupted terminal.

[str4d]

Turns out this is caused by a problem somewhere in the console crate. Switching from dialoguer to rpassword fixes the problem.