Summary
In --verbose mode, decrypt-pdf prints the PDF password in plaintext to stdout via the log_verbose "Running: ${cmd[*]}" lines, because the command array embeds --password=<PASSWORD>.
Affected strategies
try_qpdf_basic (decrypt-pdf:312)try_qpdf_hex (decrypt-pdf:331) — logs the hex-encoded passwordtry_qpdf_advanced (decrypt-pdf:346)try_gs_basic / try_gs_compat14 (via ${cmd[*]})
try_mutool already does the right thing — it logs -p '***' (decrypt-pdf:356).
Impact
Anyone running with --verbose (or capturing logs / CI output) exposes the secret. Low severity for interactive one-off use, but a real secret-in-logs leak.
Suggested fix
Mask the password in the logged command string, e.g. build a display copy of the command with --password=*** before logging, mirroring what try_mutool already does. The actual executed command keeps the real password.
Note
A characterization test (test_verbose_mode in decrypt-pdf_test.sh) asserts only that Running:/[DEBUG] appears, not the password — so masking is safe and won't break the suite.
Filed during a repo-hardening pass.
Summary
In
--verbosemode,decrypt-pdfprints the PDF password in plaintext to stdout via thelog_verbose "Running: ${cmd[*]}"lines, because the command array embeds--password=<PASSWORD>.Affected strategies
try_qpdf_basic(decrypt-pdf:312)try_qpdf_hex(decrypt-pdf:331) — logs the hex-encoded passwordtry_qpdf_advanced(decrypt-pdf:346)try_gs_basic/try_gs_compat14(via${cmd[*]})try_mutoolalready does the right thing — it logs-p '***'(decrypt-pdf:356).Impact
Anyone running with
--verbose(or capturing logs / CI output) exposes the secret. Low severity for interactive one-off use, but a real secret-in-logs leak.Suggested fix
Mask the password in the logged command string, e.g. build a display copy of the command with
--password=***before logging, mirroring whattry_mutoolalready does. The actual executed command keeps the real password.Note
A characterization test (
test_verbose_modeindecrypt-pdf_test.sh) asserts only thatRunning:/[DEBUG]appears, not the password — so masking is safe and won't break the suite.Filed during a repo-hardening pass.