Skip to content

WIP: Add password confirmation to Get-Credential #10692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
jboeshart wants to merge 11 commits into from
Closed

WIP: Add password confirmation to Get-Credential #10692

jboeshart wants to merge 11 commits into from

Conversation

@jboeshart
Copy link

@jboeshart jboeshart commented Oct 3, 2019

PR Summary

This PR adds a -ConfirmPassword parameter to Get-Credential. This helps to ensure that when entering a password, you really typed what you intended to (especially helpful with complex passwords). This only validates the text entered, and does not actually validate that the password meets any complexity requirements, nor does it actually validate it with any providers.

PR Context

Originally logged as an enhancement request in #10625.

PR Checklist

@jboeshart
Copy link
Author

jboeshart commented Oct 3, 2019

Still need to work on tests, and possibly documentation for the new parameter (need a little clarification on this).

@jboeshart jboeshart mentioned this pull request Oct 3, 2019
Closed
iSazonov
iSazonov reviewed Oct 3, 2019
View reviewed changes
iSazonov
iSazonov reviewed Oct 3, 2019
View reviewed changes
src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHostUserInterfacePrompt.cs
null,
string.Empty);
string.Empty,
confirmPassword: false);
Copy link
Collaborator

@iSazonov iSazonov Oct 3, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do the same for all arguments for consistency.

Copy link
Author

@jboeshart jboeshart Oct 3, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can do, but those were already there before I made any changes. Do you want me to include those changes here as well?

Copy link
Collaborator

@iSazonov iSazonov Oct 3, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I see. My request is to get consistency. This makes a code more readable.

Copy link
Author

@jboeshart jboeshart Oct 3, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So what do we want to do with this? Change it back to just false for consistency or leave it at confirmPassword: false?

Copy link
Collaborator

@iSazonov iSazonov Oct 3, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add names for all, not only you changed, constants.

iSazonov
iSazonov reviewed Oct 3, 2019
View reviewed changes
src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHostUserInterfaceSecurity.cs
passwordBstr = Marshal.SecureStringToBSTR(password);
retypedPasswordBstr = Marshal.SecureStringToBSTR(retypedPassword);
int passwordLength = Marshal.ReadInt32(passwordBstr, -4);
int confirmPasswordLength = Marshal.ReadInt32(retypedPasswordBstr, -4);
Copy link
Collaborator

@iSazonov iSazonov Oct 3, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See answer in https://stackoverflow.com/questions/4502676/c-sharp-compare-two-securestrings-for-equality
It looks more reliable:

        ss_bstr1_ptr = Marshal.SecureStringToBSTR(secureString1);
        ss_bstr2_ptr = Marshal.SecureStringToBSTR(secureString2);

        String str1 = Marshal.PtrToStringBSTR(ss_bstr1_ptr);
        String str2 = Marshal.PtrToStringBSTR(ss_bstr2_ptr);

        return str1.Equals(str2);
``

Make sense use Ordinal for the Equals.

iSazonov
iSazonov reviewed Oct 3, 2019
View reviewed changes
src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHostUserInterfaceSecurity.cs
WriteToConsole(passwordPrompt, true);
password = ReadLineAsSecureString();
WriteToConsole(retypePasswordPrompt, true);
retypedPassword = ReadLineAsSecureString();
Copy link
Collaborator

@iSazonov iSazonov Oct 3, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you look "else" block there is a null check that is Ctrl-C. I'd expect the same logic here too.

src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHostUserInterfaceSecurity.cs
retypedPassword = ReadLineAsSecureString();

passwordsMatch = ComparePasswords(password, retypedPassword);
if (!passwordsMatch)
Copy link
Collaborator

@iSazonov iSazonov Oct 3, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In continue my previous comment I'd reverse the logic

do 
{
    …
    if (passwd… == null)
    {
        return null;
    }

    …

    if (passwordsMatch)
    {
         return;
    }

    WriteToConsole(StringUtil.Format(ConsoleHostUserInterfaceSecurityResources…….
}
while (true);

src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHostUserInterfaceSecurity.cs
else
{
return null;
WriteToConsole(passwordPrompt, true);
Copy link
Collaborator

@iSazonov iSazonov Oct 3, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use named argument for true.

@TravisEz13 TravisEz13 added this to the 7.1.0-preview.1 milestone Nov 23, 2019
@ghost ghost assigned iSazonov Nov 23, 2019
@ghost ghost added the Review - Needed The PR is being reviewed label May 27, 2020
@ghost
Copy link

ghost commented May 27, 2020

This pull request has been automatically marked as Review Needed because it has been there has not been any activity for 7 days.
Mainainer, Please provide feedback and/or mark it as Waiting on Author

@iSazonov
Copy link
Collaborator

iSazonov commented May 27, 2020

Replaced with #12782

@iSazonov iSazonov closed this May 27, 2020
@iSazonov iSazonov removed the Review - Needed The PR is being reviewed label May 27, 2020
@iSazonov iSazonov modified the milestone: 7.1.0-preview.4 May 27, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@iSazonov iSazonov iSazonov left review comments

@anmenaga anmenaga Awaiting requested review from anmenaga

@daxian-dbw daxian-dbw Awaiting requested review from daxian-dbw daxian-dbw is a code owner

@PaulHigin PaulHigin Awaiting requested review from PaulHigin

Assignees

@iSazonov iSazonov

Labels

None yet

Projects

None yet

Milestone

7.1.0-preview.4

Development

Successfully merging this pull request may close these issues.

4 participants

@jboeshart @iSazonov @daxian-dbw @TravisEz13