[MGPG-41] Passphrase revealed when backspacing at prompt

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4
• Fix Version/s: 1.5

Environment

Mac OS X Mountain Lion

Apache Maven 3.0.3 (r1075438; 2011-02-28 11:31:09-0600)
Maven home: /usr/share/maven
Java version: 1.6.0_37, vendor: Apple Inc.
Java home: /System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home
Default locale: en_US, platform encoding: MacRoman
OS name: "mac os x", version: "10.8.2", arch: "x86_64", family: "mac"

• Assignee: stephenconnolly
• Reporter: Tony Trinh
• Created: 01/Dec/12 23:17
• Updated: 21/Feb/14 06:15
• Resolved: 21/Feb/14 06:15

Description

At the "GPG Passphrase" prompt, if I hit the backspace key during the entry, the passphrase is printed in cleartext with one less character. For example:

GPG Passphrase: ******************^R
mysecretpasswor*^R
mysecretpasswo*^R
mysecretpassw*^R
mysecretpass*^R
mysecretpas*^R
mysecretpa*^R
mysecretp*^R
mysecret*^R
mysecre*^R
mysecr*^R
mysec*^R
myse*^R
mys*^R
my*^R
m*^R
*^R
*

This can be fixed by replacing the MaskingThread with Java 6's built-in password prompt (as the code comment had suggested to do):

Console console = System.console();
if ( console != null )
{
    pass = new String( console.readPassword( "GPG Passphrase:  " ) );
}