Inconsistent treatment of secret args in export cmd
- Dominant language
- TypeScript
- Stars
- 13.8k
- Forks
- 2k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 397
Description
### Steps To Reproduce
1. `bw export --password Hunter1`
### Expected Result
When I run `bw login --apikey` or `bw unlock --passwordenv BW_PASSWORD`
I have the option of using env vars to supply the cli with sensitive values such as login creeds.
Given the encryption password for a export is important I would expect bw export to include a similar method of protecting passwords from shell history (and stack traces if the exec is called by another process).
one example could be:
`bw export --passwordenv BW_EXPORT_PASSWORD`
### Actual Result
I have no way to export via the CLI with a password without entering it as a argument
### Screenshots or Videos
_No response_
### Additional Context
_No response_
### Operating System
Windows, macOS, Linux
### Operating System Version
Fedora 38
### Shell
Bash, Zsh, PowerShell
### Build Version
2023.3.0
### Issue Tracking Info
- [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Contributor guide
Research direction
Start at the CLI export command and compare its argument handling with the existing environment-variable options for bw login --apikey and bw unlock --passwordenv. Trace how the export password is accepted, then verify that an environment-variable option avoids requiring the sensitive value as a command-line argument and is covered by the relevant CLI checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100