Console history may leak user info

[SuperYoko]

version:

./bin/nebula-console -v
nebula-console version Git: 3ce5151, Build Time: 2021-08-20T07:22:02+0000

After a user log in as root and create a user called user9 with ******

root@yk-nebula:/usr/local/nebula# ./bin/nebula-console -addr 127.0.0.1 -port 9669 -u root -p ******                                                                            
2021/09/28 09:08:28 [INFO] connection pool is initialized successfully                                                                                                         
                                                                                                                                                                               
Welcome to Nebula Graph!                                                                                                                                                       
                                                                                                                                                                                                                                                                                                
(root@nebula) [(none)]> create user user9 with password "*******"                                                                                                               
Execution succeeded (time spent 6779/7846 us)                                                                                                                                  
                                                                                                                                                                               
Tue, 28 Sep 2021 09:09:24 CST                                                                                                                                                  
                                                                                                                                                                               
(root@nebula) [(none)]> exit 

Another user may login in with same environment as other user and find root's history (even with password).

root@yk-nebula:/usr/local/nebula# ./bin/nebula-console -addr 127.0.0.1 -port 9669 -u us001 -p ******                                                                           
2021/09/28 09:10:38 [INFO] connection pool is initialized successfully                                                                                                         
                                                                                                                                                                               
Welcome to Nebula Graph!                                                                                                                                                       
                                                                                                                                                                               
(us001@nebula) [(none)]> create user user9 with password "*******"                                                                                                              
[ERROR (-1008)]: PermissionError: No permission to write user.                                                                                                                 
                                                                                                                                                                               
Tue, 28 Sep 2021 09:10:57 CST

[jievince]

Yes, it may leak user info.
What's the behavior of other shells?

[SuperYoko]

Yes, it may leak user info. What's the behavior of other shells?

Other shells? Do you mean that nebula-console behave different in different shell?
Does it rely on any function of shells?

I'll try zsh and on windows powershell/cmd and give a report if you think it's necessary.

[jievince]

Yes, I wonder what the behaviour of zsh,bash and other database's console

[SuperYoko]

Yes, I wonder what the behaviour of zsh,bash and other database's console

Tested, zsh's behavior is the same as bash's.

[jievince]

Yes, it may leak user info. What's the behavior of other shells?

Other shells? Do you mean that nebula-console behave different in different shell? Does it rely on any function of shells?

I'll try zsh and on windows powershell/cmd and give a report if you think it's necessary.

Sorry, I didn't make it clear. Actually, I want to know what is the difference between nebula-console and other databases console or other shells in recording historical commands that contain passwords.

[jievince]

1. nebula-console;
2. other database's console: MySQL, neo4j's console;
3. linux shell: bash, zsh;

[SuperYoko]

• other database's console: MySQL, neo4j's console;

Get it.

1. "nebula-console" will show history (include command with password) to any user loged in.
2. Mysql will filter out user create command. Maybe we should consider more command that may leak info(username, password, table/graph name, etc.)
3. Both linux shell will only show history of current users' past login, most password is asked after command and will not record, some inline password will leak from current user's history, while users can manually remove it.

Neo4j not deployed now, will try that later.

[HarrisChu]

As we save the history in file, user can read the password in file directly.
same behavior with mycli.