gh-138514: getpass: restrict `echo_char` to a single ASCII character by bkjoh · Pull Request #138591 · python/cpython

bkjoh · 2025-09-06T17:52:44Z

Fixesgh-138514.

📚 Documentation preview 📚: https://cpython-previews--138591.org.readthedocs.build/

…-138514)

python-cla-bot · 2025-09-06T17:52:48Z

All commit authors signed the Contributor License Agreement.

picnixz

Can you add some tests?

bkjoh · 2025-09-06T18:56:51Z

Yes! Thank you for the feedback and review. I intended to work on this some more. I will add tests and look for potential efficiencies made possible by no longer accepting multi-character strings.

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

picnixz · 2025-09-09T09:44:36Z

Note that we have 3.14-rc3 coming next week so I would like for this to be merged before if possible. If you don't have enough time, I can take over.

bkjoh · 2025-09-10T00:22:28Z

I can do this now! I apologize for the delay.

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bkjoh · 2025-09-10T01:59:04Z

I notice on Windows when an arrow key is used during password entering, two echo_char characters appear, and the password string saves the arrow key presses as control-ish characters (like "àK") due to how msvcrt.getwch() handles arrow keys. Should I address this behavior in this pull request (by ignoring/not accepting characters created through arrow key presses)? Or should I make a separate issue for this?

picnixz · 2025-09-10T05:57:39Z

Does it also happen when there is no echo char?

picnixz · 2025-09-11T08:24:23Z

However, is this an issue I should open? Using a password involving arrow keys provides a different password on Windows versus Unix systems. For example, with three left arrow key presses as a password...

I don't think it's an "issue". When I use sudo to enter my password and press left/right arrows, they are not interpreted as left/right arrows. It could be considered a feature if you think it's worth it but OTOH, I think it'll be too complex and really too niche. If the password is wrong, or if made a typo, you usually erase using backspace or re-enter the password. Should this feature be supported, a preliminary thread in https://discuss.python.org/c/ideas/6 shouold be opened.

picnixz

Could you remove the s to rejects and just use reject. It saves 1 char and we usually have test_[verb]* instead of test_[conjugated form]*.

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bkjoh · 2025-09-11T13:05:43Z

I don't think it's an "issue". When I use sudo to enter my password and press left/right arrows, they are not interpreted as left/right arrows. It could be considered a feature if you think it's worth it but OTOH, I think it'll be too complex and really too niche. If the password is wrong, or if made a typo, you usually erase using backspace or re-enter the password. Should this feature be supported, a preliminary thread in https://discuss.python.org/c/ideas/6 should be opened.

However, left/right arrows currently are being interpreted as left/right arrows in a way, right (since arrow keys are recorded as bytes/characters)? Instead of supporting this behavior, could we more simply remove it?

bkjoh · 2025-09-11T13:06:16Z

I removed the s characters. Thank you once again for your feedback!

picnixz · 2025-09-11T13:29:41Z

However, left/right arrows currently are being interpreted as left/right arrows in a way, right (since arrow keys are recorded as bytes/characters)?

I think they are interpreted that way because on Unix we use termios while on Windows it's provided by msvcrt.getwch() so we depend on that.

picnixz · 2025-09-11T14:33:46Z

Unless there is a conflict to solve or a CI test to fix (that your changes wouldn't affect), avoid merging main into your branch as it wastes CI resources. TiA!

bkjoh · 2025-09-11T15:56:23Z

Because I raise TypeError when not isinstance(echo_char, str), does the news blurb need to be updated?

picnixz · 2025-09-11T15:59:31Z

Mmh, no. If we say "we expect a string", and you give something that is not a string, usually it raises a TypeError or an AttributeError. Currently passing something like 2 raises AttributeError because of echo_char.isprintable().

bkjoh · 2025-09-15T15:21:45Z

@picnixz would you like me to make any additional modifications?

picnixz · 2025-09-15T15:51:44Z

I'll take a look tomorrow during the sprint!

miss-islington-app · 2025-09-16T14:22:10Z

Thanks @benjaminjohnson01 for the PR, and @picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

…acter (pythonGH-138591) This amends commit bf8bbe9 by restricting `echo_char` in `getpass.getpass` to single printable ASCII characters as it would be uncommon to use long strings or multi-byte characters for keyboard feedback. --------- (cherry picked from commit ab6893a) Co-authored-by: Benjamin Johnson <benjohnson2040@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>

bedevere-app · 2025-09-16T14:22:25Z

GH-138988 is a backport of this pull request to the 3.14 branch.

…racter (GH-138591) (#138988) Co-authored-by: Benjamin Johnson <benjohnson2040@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>

Accept only single character with getpass.getpass(echo_char) (see:gh…
7d412d9
…-138514)

bedevere-appBot mentioned this pull request Sep 6, 2025
getpass's echo_char should be restricted to a single ASCII character #138514
Closed

picnixz changed the title ~~getpass: restrict echo_char to a single ASCII character (gh-138514)~~gh-138514: getpass: restrict echo_char to a single ASCII characterSep 6, 2025

picnixz reviewed Sep 6, 2025
View reviewed changes

Comment threadDoc/library/getpass.rst Outdated
Comment threadLib/getpass.py Outdated
Comment threadLib/getpass.py Outdated
Comment threadLib/getpass.py Outdated
Comment threadMisc/NEWS.d/next/Library/2025-09-06-11-26-21.gh-issue-138514.66ltOb.rst Outdated

accept suggestion to reword blurb
a99e900
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

brianschubert reviewed Sep 7, 2025
View reviewed changes

Comment threadMisc/NEWS.d/next/Library/2025-09-06-11-26-21.gh-issue-138514.66ltOb.rst Outdated

bkjohand others added 8 commits September 9, 2025 20:24

reword echo_char description per suggestion
bbd741a
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

reword echo_char error message per suggestion
4338c9f
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

reword getpass echo_char news per suggestion
37a0a72
Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>

fix getpass echo_char spacing per suggestion
b063e33
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Merge branch 'main' intogh-138514-fix-getpass-echo-char
5151819

remove
fcda047

modify
4eb5701

Merge branch 'main' intogh-138514-fix-getpass-echo-char
a183a71

bkjoh added 3 commits September 9, 2025 22:32

modify TypeError message
e8d08f8

modify TypeError message again
749cc7d

add comma to ValueError message
a6aed93

bkjoh marked this pull request as ready for review September 10, 2025 02:35

bedevere-appBot added the awaiting review label Sep 10, 2025

bkjoh requested review from brianschubert and picnixz September 10, 2025 02:37

picnixz reviewed Sep 10, 2025
View reviewed changes

Comment threadLib/getpass.py Outdated
Comment threadLib/getpass.py Outdated
Comment threadLib/test/test_getpass.py Outdated
Comment threadLib/test/test_getpass.py Outdated
Comment threadLib/test/test_getpass.py Outdated
Comment threadLib/test/test_getpass.py Outdated

bkjoh marked this pull request as draft September 10, 2025 15:21

bedevere-appBot removed the awaiting review label Sep 10, 2025

bedevere-appBot added the awaiting review label Sep 10, 2025

picnixz reviewed Sep 11, 2025
View reviewed changes

Comment threadLib/test/test_getpass.py
Comment threadLib/test/test_getpass.py Outdated
Comment threadLib/test/test_getpass.py Outdated
Comment threadLib/test/test_getpass.py Outdated

bkjohand others added 6 commits September 11, 2025 08:32

remove too-verbose comments
981d49d
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

remove too-verbose comments
07534ce
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

simplify non-ascii tests using ascii
2203e03
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

test every non-printable ascii byte
6485375
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Merge branch 'main' intogh-138514-fix-getpass-echo-char
2e7bd33

remove s characters
3629a53

bkjoh requested a review from picnixz September 11, 2025 13:04

Merge branch 'main' intogh-138514-fix-getpass-echo-char
e2ba1b7

picnixz approved these changes Sep 16, 2025
View reviewed changes

bedevere-appBot added awaiting merge and removed awaiting review labels Sep 16, 2025

picnixz merged commit ab6893a into python:mainSep 16, 2025
49 checks passed

bedevere-appBot removed the awaiting merge label Sep 16, 2025

picnixz added the needs backport to 3.14 bugs and security fixes label Sep 16, 2025

bedevere-appBot removed the needs backport to 3.14 bugs and security fixes label Sep 16, 2025

Uh oh!

Uh oh!

Conversation

bkjoh commented Sep 6, 2025• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

python-cla-botBot commented Sep 6, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bkjoh commented Sep 6, 2025

Uh oh!

Uh oh!

picnixz commented Sep 9, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bkjoh commented Sep 10, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bkjoh commented Sep 10, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz commented Sep 10, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

picnixz commented Sep 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bkjoh commented Sep 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bkjoh commented Sep 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz commented Sep 11, 2025

Uh oh!

picnixz commented Sep 11, 2025

Uh oh!

bkjoh commented Sep 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz commented Sep 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bkjoh commented Sep 15, 2025

Uh oh!

picnixz commented Sep 15, 2025

Uh oh!

Uh oh!

miss-islington-appBot commented Sep 16, 2025

Uh oh!

bedevere-appBot commented Sep 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bkjoh commented Sep 6, 2025•
edited by github-actions Bot
Loading

python-cla-botBot commented Sep 6, 2025•
edited
Loading

picnixz commented Sep 9, 2025•
edited
Loading

bkjoh commented Sep 10, 2025•
edited
Loading

bkjoh commented Sep 10, 2025•
edited
Loading

picnixz commented Sep 11, 2025•
edited
Loading

bkjoh commented Sep 11, 2025•
edited
Loading

bkjoh commented Sep 11, 2025•
edited
Loading

bkjoh commented Sep 11, 2025•
edited
Loading

picnixz commented Sep 11, 2025•
edited
Loading