x/crypto/ssh/terminal: ReadPassword reads a maximum of 254 chars on Windows #36071

ncw · 2019-12-10T16:36:38Z

What version of Go are you using (`go version`)?

$ go version
go version go1.13.5 windows/amd64

Does this issue reproduce with the latest release?

Yes (not tried tip)

What operating system and processor architecture are you using (`go env`)?

go env Output

$ go env
set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\Administrator\AppData\Local\go-build
set GOENV=C:\Users\Administrator\AppData\Roaming\go\env
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\Administrator\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=c:\go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=c:\go\pkg\tool\windows_amd64
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=C:\Users\Administrator\go\src\github.com\rclone\rclone\go.mod
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fmessage-length=0 -fdebug-prefix-map=C:\Users\ADMINI~1\AppData\Local\Temp\2\go-build381157862=/tmp/go-build -gno-record-gcc-switches

What did you do?

I ran this program and typed > 254 characters

package main

import (
       "os"
       "fmt"
       "golang.org/x/crypto/ssh/terminal"
)

func main() {
        val, err := terminal.ReadPassword(int(os.Stdin.Fd()))
        fmt.Println(err)
        fmt.Printf("len=%d: %q\n", len(val), val)
}

What did you expect to see?

I expected to see all the characters I typed or an error message

What did you see instead?

My input string silently truncated to the first 254 characters.

go run x.go
<nil>
len=254: "alskdjflaskdjfaslkdfjlskdjflaksdjflskdjfalsdkfjlsakdfjlasdkfjlaskdfjalskdfjlasdkfjlasdkfjlsadkfjlasdkfjlsadkfjadslkfjlasdkfjadslkfjlasdkfjlakdsfjldsakfjlasdkfjlsadkfjlasdkfjlskdfjlaskdfjlakdsfjladksfjlaskdfjladksfjlasdkfjalsdkfjlasdkfjladskfjasldkfjalsdf"

The text was updated successfully, but these errors were encountered:

toothrot · 2019-12-10T19:10:15Z

/cc @FiloSottile @katiehockman @alexbrainman

As you mentioned, this does look to be windows specific. I was not able to reproduce this on Linux.

alexbrainman · 2019-12-21T02:10:51Z

@ncw I can reproduce your problem.

I briefly looked at your code, and I cannot see why returned result is limited to 254 chars.

Maybe @mattn know.

Alex

silviucm · 2019-12-21T15:42:48Z

@ncw @alexbrainman
Not exactly sure if applicable, so apologies in advance, but here's a .NET doc page that mentions the 254 character limitation, due to a default internal buffer, and suggests an alternative

https://docs.microsoft.com/en-us/dotnet/api/system.console.readline?view=netframework-4.8

By default, the method reads input from a 256-character input buffer. Because this includes the Environment.NewLine character(s), the method can read lines that contain up to 254 characters. To read longer lines, call the OpenStandardInput(Int32) method.

From what I am seeing here, it's pointing to that:
https://github.com/golang/go/blob/master/src/internal/poll/fd_windows.go#L540

In case the same API is used, that may explain what's happening

mattn · 2019-12-21T18:00:49Z

It is limit of ENABLE_LINE_INPUT. When using ReadConsole with ENABLE_LINE_INPUT, the input buffer always be 254 (256 - \r - \n). To solve this issue, ReadPassword stop to use ENABLE_LINE_INPUT.

diff --git a/ssh/terminal/terminal.go b/ssh/terminal/terminal.go
index 2f04ee5..ea2cd57 100644
--- a/ssh/terminal/terminal.go
+++ b/ssh/terminal/terminal.go
@@ -946,11 +946,17 @@ func readPasswordLine(reader io.Reader) ([]byte, error) {
 	for {
 		n, err := reader.Read(buf[:])
 		if n > 0 {
-			switch buf[0] {
+			switch byte(buf[0]) {
+			case '\b':
+				if len(ret) > 0 {
+					ret = ret[:len(ret)-1]
+				}
 			case '\n':
 				return ret, nil
 			case '\r':
-				// remove \r from passwords on Windows
+				// On Windows, \n never read when ENABLE_LINE_INPUT is
+				// disabled.
+				return ret, nil
 			default:
 				ret = append(ret, buf[0])
 			}
diff --git a/ssh/terminal/util_windows.go b/ssh/terminal/util_windows.go
index 5cfdf8f..c2cdf24 100644
--- a/ssh/terminal/util_windows.go
+++ b/ssh/terminal/util_windows.go
@@ -85,8 +85,8 @@ func ReadPassword(fd int) ([]byte, error) {
 	}
 	old := st
 
-	st &^= (windows.ENABLE_ECHO_INPUT)
-	st |= (windows.ENABLE_PROCESSED_INPUT | windows.ENABLE_LINE_INPUT | windows.ENABLE_PROCESSED_OUTPUT)
+	st &^= (windows.ENABLE_ECHO_INPUT | windows.ENABLE_LINE_INPUT | windows.ENABLE_PROCESSED_INPUT)
+	st |= windows.ENABLE_PROCESSED_OUTPUT
 	if err := windows.SetConsoleMode(windows.Handle(fd), st); err != nil {
 		return nil, err
 	}

mattn · 2019-12-21T18:10:36Z

Sorry, the code above is wrong. we must stop to use ENABLE_PROCESSED_INPUT too.

mattn · 2019-12-21T18:30:07Z

For the note: dotnet/corefx@f374612

gopherbot · 2019-12-21T18:40:40Z

Change https://golang.org/cl/212377 mentions this issue: ssh/terminal: Stop using ENABLE_LINE_INPUT

ncw · 2020-01-20T12:44:20Z

I merged this fix into rclone however @Ajaja reported in rclone/rclone#3888 that the Enter key no longer works.

I can confirm this, the little test program above fails on WIndows 10 - you can't press Enter to end the input.

Sorry, I missed the new issue about this #36609

alexbrainman · 2020-01-23T09:21:07Z

I merged this fix into rclone however @Ajaja reported in rclone/rclone#3888 that the Enter key no longer works.

Sorry for submitting completely broken version.

Sorry, I missed the new issue about this #36609

Yes. The fix https://go-review.googlesource.com/c/crypto/+/215417 is out for review.

Alex

Currently we are using simple Input to read token. Due to some limitation adn echoing it will be better to read it as password. > ReadConsole does not read more than 254 bytes when ENABLE_LINE_INPUT is enabled. Refs: golang/go#36071

ReadConsole does not read more than 254 bytes when ENABLE_LINE_INPUT is enabled. Fixes golang/go#36071 Change-Id: If5c160404b855387a80f1d57638aac3f2db1a097 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/212377 Run-TryBot: Alex Brainman <alex.brainman@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Alex Brainman <alex.brainman@gmail.com>

gopherbot added this to the Unreleased milestone Dec 10, 2019

ncw mentioned this issue Dec 10, 2019

GetPassword limited to 254 characters on Windows rclone/rclone#3798

Closed

toothrot added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Dec 10, 2019

gopherbot closed this as completed in golang/crypto@6d4e4cb Jan 15, 2020

toothrot mentioned this issue Jan 16, 2020

x/crypto/ssh/terminal: ReadPassword() ignores Return-Key #36609

Closed

janisz mentioned this issue Aug 17, 2020

Use ReadPassword to read token. dcos/dcos-cli#1551

Merged

golang locked and limited conversation to collaborators Jan 22, 2021

gopherbot added the FrozenDueToAge label Jan 22, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

x/crypto/ssh/terminal: ReadPassword reads a maximum of 254 chars on Windows #36071

x/crypto/ssh/terminal: ReadPassword reads a maximum of 254 chars on Windows #36071

ncw commented Dec 10, 2019

toothrot commented Dec 10, 2019

alexbrainman commented Dec 21, 2019

silviucm commented Dec 21, 2019

mattn commented Dec 21, 2019 •

edited

mattn commented Dec 21, 2019

mattn commented Dec 21, 2019

gopherbot commented Dec 21, 2019

ncw commented Jan 20, 2020 •

edited

alexbrainman commented Jan 23, 2020

x/crypto/ssh/terminal: ReadPassword reads a maximum of 254 chars on Windows #36071

x/crypto/ssh/terminal: ReadPassword reads a maximum of 254 chars on Windows #36071

Comments

ncw commented Dec 10, 2019

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

toothrot commented Dec 10, 2019

alexbrainman commented Dec 21, 2019

silviucm commented Dec 21, 2019

mattn commented Dec 21, 2019 • edited

mattn commented Dec 21, 2019

mattn commented Dec 21, 2019

gopherbot commented Dec 21, 2019

ncw commented Jan 20, 2020 • edited

alexbrainman commented Jan 23, 2020

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?

mattn commented Dec 21, 2019 •

edited

ncw commented Jan 20, 2020 •

edited