spring-shell icon indicating copy to clipboard operation
spring-shell copied to clipboard

Consider using Console for secure inputs

Open ghillert opened this issue 6 years ago • 0 comments
trafficstars

Currently we use the InputStreamReader. Console provides the readPassword(). Also, in certain situations, e.g. in Eclipse the password will be shown nevertheless, despite setting echo to false:

userInput.prompt("Proxy Server Password", "", false);

Using Console we can test whether the console is available, and we can at least provide a warning to the user in case the Console is unavailble:

Console console = System.console();
if (console == null) {
    System.out.println("WARNING - Passwords are shown!");
    return new Scanner(System.in).next();
}
...

ghillert avatar Feb 11 '19 10:02 ghillert