Does AppleScript’s do shell script log in history

applescriptSecurityterminal

I frequently use the do shell script command in AppleScript (AS) to return some information, including encrypted text.

One such example is:

set encrypted to (do shell script "echo 'my secret text' | openssl enc -aes-256-cbc -a -pass pass:Pass123")

If run in Terminal, this command logs in the history and can be viewed by typing: history, then pressing the Return key.

Problem:
The above example includes the plain text password as a parameter, and it shows in the history (when run in Terminal), from where it can easily be copied and used to reverse the encrypted string, no knowledge required.

AppleScript's log do shell script "history" command returns no data. Likewise, running the history command in the terminal – after the example encryption was run through AS, it also does not display the AS terminal command in this history. All in all, it leads me to believe that the AS command was obviously executed through a different shell. Knowing that the shell differs for every user (ie. my account cannot see the terminal history of another account), the question follows.

Question:
Does that mean there is no record of the AS command in any of the histories and logs kept by macOS at any time? Or is it burried somewhere accessible where it can be read, interpreted and hence the encryption reversed?

Though perhaps thought-provoking and open to opinion, I think it is within the answerable realm of questions. I am interested in the answer from a security point-of-view and hope to get a clearer picture of if / how / where terminal logs AS commands – like Terminal does with the history.
Thanks everyone.

Best Answer

If you run the following do shell script command in Script Editor:

do shell script "set"

Shown farther below is what's returned.

As one can see, there are no history related shell variables set and as such, to make a longer story short, there is no command history being saved.

If you want to read further, have a look at the HISTORY section in the bash manual page,

Also may be of interest, other command history Shell Variables e.g., HISTCONTROL, HISTFILE HISTFILESIZE, HISTIGNORE, HISTSIZE, HISTIGNORE, HISTSIZE and HISTTIMEFORMAT.


Also of note, when a Run Shell Script action in an Automator workflow is run, the same applies there as well, for the same reason as with the do shell script command in Script Editor, no history related shell variables are set.


Output of the set command from an AppleScript do shell script command:

Apple_PubSub_Socket_Render=/private/tmp/com.apple.launchd.HPRIi1Tsop/Render
BASH=/bin/sh
BASH_ARGC=()
BASH_ARGV=()
BASH_EXECUTION_STRING=set
BASH_LINENO=()
BASH_SOURCE=()
BASH_VERSINFO=([0]=\"3\" [1]=\"2\" [2]=\"57\" [3]=\"1\" [4]=\"release\" [5]=\"x86_64-apple-darwin17\")
BASH_VERSION='3.2.57(1)-release'
DIRSTACK=()
EUID=501
GROUPS=()
HOME=/Users/me
HOSTNAME=mes-Mac.local
HOSTTYPE=x86_64
IFS='   
'
LOGNAME=me
MACHTYPE=x86_64-apple-darwin17
OPTERR=1
OPTIND=1
OSTYPE=darwin17
PATH=/usr/bin:/bin:/usr/sbin:/sbin
POSIXLY_CORRECT=y
PPID=4330
PS4='+ '
PWD=/
SHELL=/bin/bash
SHELLOPTS=braceexpand:hashall:interactive-comments:posix
SHLVL=1
SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.WQb3vmbYE7/Listeners
TERM=dumb
TMPDIR=/var/folders/w0/lht0h70x06b8hdb5lx474pkc0000gn/T/
UID=501
USER=me
XPC_FLAGS=0x0
XPC_SERVICE_NAME=0
_=sh
__CF_USER_TEXT_ENCODING=0x1F5:0x0:0x0