feat: don't store if MIME==x-kde-passwordManagerHint

cliphist.go

@@ -10,6 +10,7 @@ import (
 	"image"
 	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -82,11 +83,30 @@ func main() {
 	}
 }
 
+func filterPasswordType() error {
+	out, err := exec.Command("wl-paste", "--list-types").Output()
+	if err != nil {
+		return fmt.Errorf("error while checking MIME types of clipboard data: %w", err)
+	}
+	if strings.Contains(string(out), "x-kde-passwordManagerHint") {
+		return fmt.Errorf("password data detected, not storing")
+	}
+
+	return nil
+}
+
 func store(in io.Reader, maxDedupeSearch, maxItems uint64) error {
 	input, err := io.ReadAll(in)
 	if err != nil {
 		return fmt.Errorf("read stdin: %w", err)
 	}
+	if err := filterPasswordType(); err != nil {
+		if err.Error() == "password data detected, not storing" {
+			return nil
+		}
+		return err
+	}
+
 	if len(input) > 5*1e6 { // don't store >5MB
 		return nil
 	}

cliphist_test.go

@@ -10,6 +10,7 @@ import (
 	"io"
 	mathrand "math/rand"
 	"os"
+	"os/exec"
 	"strconv"
 	"testing"
 
@@ -46,6 +47,36 @@ func TestMain(m *testing.M) {
 	}))
 }
 
+func TestFilterPasswordType(t *testing.T) {
+	tests := []struct {
+		name          string
+		inCommandArgs []string
+		want          string
+	}{{
+		name:          "explicitly specified x-kde-passwordManagerHint",
+		inCommandArgs: []string{"--type", "x-kde-passwordManagerHint", "testvalue"},
+		want:          "password data detected, not storing",
+	}, {
+		name:          "random string",
+		inCommandArgs: []string{"testvalue-blah"},
+		want:          "",
+	},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := exec.Command("wl-copy", tt.inCommandArgs...).Run(); err != nil {
+				t.Errorf("failed to run wl-copy: %v", err)
+			}
+			got := filterPasswordType()
+			if got != nil && got.Error() != tt.want {
+				t.Errorf("filterPasswordType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+
+}
+
 func TestScripts(t *testing.T) {
 	testscript.Run(t, testscript.Params{
 		Dir:                 "testdata",