[GH-ISSUE #216] Including `command` in asciinema recordings is a security problem #773

New issue

Closed

opened 2026-03-15 10:20:48 +03:00 by kerem · 5 comments

kerem commented

2026-03-15 10:20:48 +03:00

Owner

Originally created by @cemerick on GitHub (Jul 17, 2017).
Original GitHub issue: https://github.com/asciinema/asciinema/issues/216

I discovered that if I provide a command e.g. asciinema rec -c 'export API_KEY=...; ./script.sh' output.json, then that command will be included verbatim in output.json in the command slot. Now that I know this, I can take care to put sensitive information (like API keys, URLs for private services, etc) in a script or scrub the output to null out the command attribute, but I'd like to suggest that command be included only when explicitly requested.

Originally created by @cemerick on GitHub (Jul 17, 2017). Original GitHub issue: https://github.com/asciinema/asciinema/issues/216 I discovered that if I provide a command e.g. `asciinema rec -c 'export API_KEY=...; ./script.sh' output.json`, then that command will be included verbatim in `output.json` in the `command` slot. Now that I know this, I can take care to put sensitive information (like API keys, URLs for private services, etc) in a script or scrub the output to null out the `command` attribute, but I'd like to suggest that `command` be included only when explicitly requested.

kerem

2026-03-15 10:20:48 +03:00

closed this issue
added the
improvement
label

kerem commented

2026-03-15 10:21:06 +03:00

Author

Owner

@ku1ik commented on GitHub (Jul 17, 2017):

Good catch. For some reason it never occured to me (and I am person who does care about privacy in general).

We can either disable it by default and add a switch + config file option like you suggested, or we can include command when recording to a file but drop it from JSON when uploading (both when uploading implicitly through asciinema rec or when doing it explicitly from local file through asciinema upload file.json).

@ku1ik commented on GitHub (Jul 17, 2017): Good catch. For some reason it never occured to me (and I am person who does care about privacy in general). We can either disable it by default and add a switch + config file option like you suggested, or we can include `command` when recording to a file but drop it from JSON when uploading (both when uploading implicitly through `asciinema rec` or when doing it explicitly from local file through `asciinema upload file.json`).

kerem commented

2026-03-15 10:21:11 +03:00

Author

Owner

@cemerick commented on GitHub (Jul 17, 2017):

rec time is really when it matters; especially for those that are self-hosting the player (like me), the assumption is that you can just drop the JSON file anywhere as-is.

@cemerick commented on GitHub (Jul 17, 2017): `rec` time is really when it matters; especially for those that are self-hosting the player (like me), the assumption is that you can just drop the JSON file anywhere as-is.

kerem commented

2026-03-15 10:21:16 +03:00

Author

Owner

@ku1ik commented on GitHub (Jul 17, 2017):

Fair enough. There's not that much use for it anyway - we display it on the recording page in place of a title when a title was not explicitly set and the recording explicitly specified the command via -c (which is less frequent case).

@ku1ik commented on GitHub (Jul 17, 2017): Fair enough. There's not _that_ much use for it anyway - we display it on the recording page in place of a title when a title was not explicitly set and the recording explicitly specified the command via `-c` (which is less frequent case).

kerem commented

2026-03-15 10:21:21 +03:00

Author

Owner

@cemerick commented on GitHub (Jul 17, 2017):

In that case, it seems like you want exactly the reverse of what you suggested: exclude when writing the file, but include when uploading?

@cemerick commented on GitHub (Jul 17, 2017): In that case, it seems like you want exactly the reverse of what you suggested: exclude when writing the file, but include when uploading?

kerem commented

2026-03-15 10:21:27 +03:00

Author

Owner

@ku1ik commented on GitHub (Oct 27, 2017):

This was solved in #234.

@ku1ik commented on GitHub (Oct 27, 2017): This was solved in #234.