FYI: The sudo-rs bug of leaking passwords on timeout is a general problem of line buffered stdin streams.
The `read` builtin suffers from the same problem.
https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw
Post
FYI: The sudo-rs bug of leaking passwords on timeout is a general problem of line buffered stdin streams.
The `read` builtin suffers from the same problem.
https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw
This issue occurs when using a line buffer, where the input is only placed into the buffer after a newline character was entered. When that character is not entered, the data is not read, and thus not flushed from stdin and is still waiting to be read by the next program (such as the shell) to read from the stdin buffer. Bash uses a character buffer to read your keyboard inputs, so the data is displayed immediately.
A space for Bonfire maintainers and contributors to communicate