github / github/copilot-cli

Copilot CLI prompts for WSL sudo password without obscuring input (password echoed)

未關閉
#2,542 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
area:permissions area:platform-windows
主要語言
Shell
星號
11.2k
分支
1.9k
平均合併
14 小時 16 分鐘
30 天內合併 PR
6

描述

### Summary
When GitHub Copilot CLI prompts for a WSL sudo password (to forward it into the WSL prompt), the typed password characters are not obscured and appear on screen in plain text. This is a security risk and can lead to password disclosure (e.g., during screen sharing, recordings, or over-the-shoulder viewing).

### Steps to Reproduce
1. Run Copilot CLI in a scenario where it needs elevated privileges inside WSL (sudo).
2. When prompted with something like:
`Please enter your WSL sudo password (I'll send it to the prompt):`
3. Type the sudo password.

### Expected Behavior
Password input should be obscured (no echo), similar to standard terminal password prompts:
- No visible characters while typing, or
- Use a secure prompt mechanism that disables echo.

### Actual Behavior
Password characters are visible while typing (echoed to the terminal).

### Impact / Security Considerations
- Risk of password exposure during screen shares, demos, live streams, recordings, or in shared work environments.
- Potential leakage into terminal logs depending on the host shell/terminal configuration.

### Environment
OS: Windows (using WSL)
WSL distro: Ubuntu (WSL 2)
Copilot CLI version: 1.0.19
Terminal: Windows Terminal
Shell: PowerShell Core 7.6.0

### Suggested Fix / Notes
- Use a proper no-echo password input method on Windows terminals (e.g., a secure prompt / TTY no-echo).
- Ensure the password is not printed, logged, or stored, and is only forwarded to the target sudo prompt.

貢獻指南

開啟貢獻指南

研究方向

從顯示「Please enter your WSL sudo password」的 Copilot CLI 流程開始,追蹤在 Windows Terminal 中透過 PowerShell 執行時輸入是如何被讀取的。使用 WSL Ubuntu 重現該提示,然後驗證在密碼轉送給 sudo 的過程中,密碼字元不會被回顯、記錄或儲存。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
powershell, shell, ubuntu
領域
cli, operating-systems, security
Issue 類型
缺陷
難度
3/5
預估耗時
1-2 天
活躍度
冷清
描述清晰度
基本清楚
新手友好度
52/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。