Closed
Description
opened on May 26, 2023
What You Are Seeing?
When passing --user
and --password
options to Chocolatey CLI, the parameters can be seen when viewing the arguments in Chocolatey GUI.
What is Expected?
When passing sensitive inputs through Chocolatey CLI, users should not be able to see those arguments by viewing the package arguments in the GUI.
How Did You Get This To Happen? (Steps to Reproduce)
- Install Chocolatey (Version 1.4.0 was used for replication)
- Install Chocolatey GUI
choco install chocolateygui --confirm
- Enable remembered arguments for upgrades
choco feature enable --name='useRememberedArgumentsForUpgrades'
- Install something else with [Source] (optional) / Username / Password
choco install nexushell --User bob --Password "bill"
- Click into the package within Chocolatey GUI and click View Package Arguments, see the options in plain text
System Details
- Operating System: Windows 10
- Windows PowerShell Version: 5
- Chocolatey CLI Version: 1.4.0
- Chocolatey Licensed Extension version: N/A
- Chocolatey License type (Professional / Business / ?): N/A
- Terminal/Emulator: powershell.exe
Activity