CLI reveals passwords containing inverted commas

[sjcorbett]

For example, if I changed my password to "hello-world:

$ CF_TRACE=true cf passwd

Current Password>

New Password>

Verify Password>
Changing password...

REQUEST: [2015-08-18T16:51:10+01:00]
PUT /Users/4238e7f5-4155-4730-b4ba-b72a909259de/password HTTP/1.1
Host: example.com
Accept: application/json
Authorization: [PRIVATE DATA HIDDEN]
Content-Type: application/json
User-Agent: go-cli 6.12.2-24abed3 / darwin

{"password":"[PRIVATE DATA HIDDEN]"hello-world","oldPassword":"[PRIVATE DATA HIDDEN]"}

Everything past the initial inverted comma has been revealed.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/101509044.

[sjcorbett]

Using cf version 6.12.2-24abed3-2015-07-15T21:21:22+00:00.

[Zouuup]

nice catch @sjcorbett !