Skip to content

Opening a file directly from the command line and pasting in insert mode briefly flash the non-cloaked values #25

Description

@ph1losof

Hi, I have noticed a few bugs when using cloak.nvim which lead to leaking sensitive values, this is critical since a lot of online content can be played back in time.

Opening files directly

When opening a file directly using neovim filename there is a brief flash of unmasked values

CleanShot.2025-02-19.at.22.44.45.mp4

Pasting content inside insert mode

When trying to copy-paste content in insert mode as for example using cmd+v, there is brief flash of unmasked value

CleanShot.2025-02-19.at.22.50.11.mp4

You can take a look at the implementation from my plugin - ecolog.nvim, It can be used as a nearly drop-in replacement for cloak.nvim for masking sensitive data, it provides all-in-one toolkit to work with environment variables and .env files. You can take a look at the comparisons table

Activity

  1. ph1losof commented on Feb 19, 2025

    @ph1losof
    Author

    There are some parts of code which can be useful for fixing them both:

    This provides more aggressive approach for handling buffer read event fixes issue number 1

    That overrides paste command and fixes issue 2

  2. laytan commented on Mar 5, 2025

    @laytan
    Owner

    This should definitely be fixed, patches are welcome.

  3. changed the title [-][Bugs]: Cloak.nvim leaks sensitive values[/-] [+]Opening a file directly from the command line and pasting in insert mode briefly flash the non-cloaked values[/+] on Mar 5, 2025
  4. ph1losof commented on Mar 5, 2025

    @ph1losof
    Author

    Ok, I may even contribute via pr to fixing it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinghelp wantedExtra attention is needed

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions