Does xdotool have a log?

Question

I'm using xdotool to securely type out a password (as opposed to using the clipboard) from a password manager (pass) and I'm wondering if xdotool has a log somewhere, which would obviously make it insecure.

So it there a log, or any other potential insecurity that anyone else can see?

For reference, this is what I'm using:

#!/usr/bin/env python3
import subprocess
import sys
from time import sleep

if len(sys.argv) == 2:
    delay = int(sys.argv[1])
else:
    delay = 3

data = sys.stdin.readline().rstrip('\n')
sleep(delay)
subprocess.call(['xdotool', 'type', '--clearmodifiers', data])

Answer 1

So there is no xdotool log as far as I am aware, but as kasperd pointed out, running xdotool with the password as an argument is clearly insecure. But we may pass in the password through a pipe to avoid it showing up in the output of ps aux.

echo -n "$pass" | xdotool type --clearmodifiers --file -

By default (in bash), the builtin version of echo is used, which does not execute as it's own process, so doesn't show up in ps. You can run builtin echo if you're not sure which version will be used.

Answer 2

Instead of calling xdotool using Python's subprocess.call() you should directly interface with the library underlying xdotool: libxdo.

The bindings for Python are available in python-libxdo and allows you to "type" the password from within Python without ever showing up in ps aux, as there is no separate process invoked.