Passwords are not correctly hidden, contrary to getpass.getpass()

[fbauzac]

Hello,

I don't know how prompt_toolkit tries to hide passwords, but it looks
like passwords are not correctly hidden. In particular, using Emacs I
can see that contrary to getpass.getpass() the password is not
correctly hidden. I don't know what getpass() does that
prompt_toolkit does not though.

Emacs can be used to reveal the problem.

To reproduce the problem:

Start a shell within Emacs:

$ emacs -Q --eval "(shell)"

Within the shell within Emacs, try getpass(), entering "abc" as
password:

$ python3 -c "import getpass; getpass.getpass(\"Password: \")"
Password: 
$

As you can see, the password is not displayed.

And try using prompt_toolkit, entering "abc" as password:

$ python3 -c "import prompt_toolkit; prompt_toolkit.prompt(\"Password: \", is_password=True)"
Password: abc
$

As you can see, contrary to getpass(), the password is shown.

Does prompt_toolkit have issues setting the terminal in noecho mode?

Does prompt_toolkit really display the password characters and then
tries to replace them very quickly, contrary to getpass() which
effectively hides the password?

Is there something else not properly set up in prompt_toolkit compared
to getpass()?

Note: to exit Emacs, do: control-x control-c and watch for any prompts at the bottom left of the screen.

Thanks!

Best regards
Fabrice