I frequently use the do shell script
command in AppleScript (AS) to return some information, including encrypted text.
One such example is:
set encrypted to (do shell script "echo 'my secret text' | openssl enc -aes-256-cbc -a -pass pass:Pass123")
If run in Terminal, this command logs in the history and can be viewed by typing: history
, then pressing the Return key.
Problem:
The above example includes the plain text password as a parameter, and it shows in the history (when run in Terminal), from where it can easily be copied and used to reverse the encrypted string, no knowledge required.
AppleScript's log do shell script "history"
command returns no data. Likewise, running the history
command in the terminal – after the example encryption was run through AS, it also does not display the AS terminal command in this history. All in all, it leads me to believe that the AS command was obviously executed through a different shell. Knowing that the shell differs for every user (ie. my account cannot see the terminal history of another account), the question follows.
Question:
Does that mean there is no record of the AS command in any of the histories and logs kept by macOS at any time? Or is it burried somewhere accessible where it can be read, interpreted and hence the encryption reversed?
Though perhaps thought-provoking and open to opinion, I think it is within the answerable realm of questions. I am interested in the answer from a security point-of-view and hope to get a clearer picture of if / how / where terminal logs AS commands – like Terminal does with the history.
Thanks everyone.
Best Answer
If you run the following
do shell script
command in Script Editor:Shown farther below is what's returned.
As one can see, there are no history related shell variables set and as such, to make a longer story short, there is no command history being saved.
If you want to read further, have a look at the HISTORY section in the
bash
manual page,Also may be of interest, other command history Shell Variables e.g., HISTCONTROL, HISTFILE HISTFILESIZE, HISTIGNORE, HISTSIZE, HISTIGNORE, HISTSIZE and HISTTIMEFORMAT.
Also of note, when a Run Shell Script action in an Automator workflow is run, the same applies there as well, for the same reason as with the
do shell script
command in Script Editor, no history related shell variables are set.Output of the
set
command from an AppleScriptdo shell script
command: