bitwarden / bitwarden/clients

Inconsistent treatment of secret args in export cmd

Open
#5,835 6 comments 0 reactions 0 assignees View on GitHub
bug cli
Dominant language
TypeScript
Stars
13.8k
Forks
2k
Avg merge
3d 9h
Merged PRs (30d)
397

Description

### Steps To Reproduce

1. `bw export --password Hunter1`

### Expected Result

When I run `bw login --apikey` or `bw unlock --passwordenv BW_PASSWORD`
I have the option of using env vars to supply the cli with sensitive values such as login creeds.
Given the encryption password for a export is important I would expect bw export to include a similar method of protecting passwords from shell history (and stack traces if the exec is called by another process).
one example could be:
`bw export --passwordenv BW_EXPORT_PASSWORD`

### Actual Result

I have no way to export via the CLI with a password without entering it as a argument

### Screenshots or Videos

_No response_

### Additional Context

_No response_

### Operating System

Windows, macOS, Linux

### Operating System Version

Fedora 38

### Shell

Bash, Zsh, PowerShell

### Build Version

2023.3.0

### Issue Tracking Info

- [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start at the CLI export command and compare its argument handling with the existing environment-variable options for bw login --apikey and bw unlock --passwordenv. Trace how the export password is accepted, then verify that an environment-variable option avoids requiring the sensitive value as a command-line argument and is covered by the relevant CLI checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
nodejs, typescript
Domain
cli, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.