CLI freezes in shell mode when connecting using interactive password a with long value

[sauroter]

Expected behavior

Client connects with password set to a long value.

Actual behavior

CLI becomes unresponsive and needs to be terminated with CTRL+C.

To Reproduce

Steps

$ mqtt sh
$ con -pw
Enter value for --password (The password for authentication): $

Enter long password, e.g. a JWT.

Reproducer code

No code.

Details

1.0.1
Picocli 4.0.4
JVM: 11.0.4 (AdoptOpenJDK OpenJDK 64-Bit Server VM 11.0.4+11)
OS: Mac OS X 10.15 x86_64

[gitseti]

Thanks @sauroter,

the bug is happening because the picocli interactive mode for password reading is using the Console.readPassword() function. This functions seems to only support reading up to 1024 characters. If you copy-paste a string with more than 1024 characters the excess characters get truncated. The problem now is that the readPassword method cannot process the next char which would be the newLine character to confirm the password. You can verify this by deleting the last character in the interactive mode via backspace and then pressing Enter which should work.

This problem can be tracked back to the tty driver’s internal buffer which seems to be capped at 1024 characters for OS X.

Suggested solution:

I think the best and more secure practice to read longer passwords should be to provide a functionality which lets me read the password from a file or via an environment variable as suggested in a picocli example:

    @Option(names = "--pw:file")
    File passwordFile;

    @Option(names = "--pw:env")
    String passwordEnvironmentVariable;

    @Option(names = "--pw", interactive = true, /* ... */)
    String password;

	/* ... */

		if (password != null) {
            login(password);
        } else if (passwordEnvironmentVariable != null) {
            login(System.getenv(passwordEnvironmentVariable));
        } else if (passwordFile != null) {
            // below uses Java 8 NIO, create your own on older Java versions
            /*
            login(new String(Files.readAllBytes(passwordFile.toPath())));
            */

What do you think of this solution or could it be that I'm missing something?

[sauroter]

Thanks for looking into this!

I like the solution with environment variables. But thats just my opinion :)