`readline` history incorrectly includes input from `rl.question()`

[thedrlambda]

Version

v20.19.4, v22.18.0, v24.5.0

Platform

Microsoft Windows NT 10.0.26100.0 x64

Docker Desktop: 

* node:current-alpine
* node:lts-alpine
* node:20-alpine
* node:20

Subsystem

readline

What steps will reproduce the bug?

// file.js
const readline = require("node:readline");

const rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout,
  prompt: "CMD > ",
});

console.log('Type "history" to see Node.js internal history.');
rl.prompt();

rl.on("line", (line) => {
  const cmd = line.trim().toLowerCase();

  if (cmd === "ask") {
    rl.question("Enter secret (not in history): ", (answer) => {
      console.log(`> Secret was "${answer}".`);
      rl.prompt();
    });
  } else if (cmd === "history") {
    console.log("--- Node.js Internal History ---");
    console.log(rl.history);
    console.log("------------------------------");
    rl.prompt();
  } else if (cmd === "exit") {
    rl.close();
  } else {
    console.log(`> Command was "${cmd}"`);
    rl.prompt();
  }
});

rl.on("close", () => process.exit(0));

Run node test.js.

Enter the following commands in sequence:

1. ask
2. my-secret (when prompted)
3. history

How often does it reproduce? Is there a required condition?

Every time.

What is the expected behavior? Why is that the expected behavior?

[ 'history', 'ask' ]

The my-secret input to the question should be excluded.

What do you see instead?

[ 'history', 'my-secret', 'ask' ]

Additional information

No response

[pckrishnadas88]

You could change this behavior with a temporary fix something like this.

const readline = require("node:readline");

const rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout,
  prompt: "CMD > ",
});

console.log('Type "history" to see Node.js internal history.');
rl.prompt();

rl.on("line", (line) => {
  const cmd = line.trim().toLowerCase();

  if (cmd === "ask") {
    rl.question("Enter secret (not in history): ", (answer) => {
      // Remove the SECOND LAST history entry (secret input)
      if (rl.history.length >= 2) {
        rl.history.splice(rl.history.length - 2, 1); // Remove second last item
      }

      console.log(`> Secret was "${answer}".`);
      rl.prompt();
     
    });
  } else if (cmd === "history") {
    console.log("--- Node.js Internal History ---");
    console.log(rl.history);
    console.log("------------------------------");
    rl.prompt();
  } else if (cmd === "exit") {
    rl.close();
  } else {
    console.log(`> Command was "${cmd}"`);
    rl.prompt();
  }
});

rl.on("close", () => process.exit(0));

Which will result in

Type "history" to see Node.js internal history.
CMD > ask
Enter secret (not in history): my-secret
> Secret was "my-secret".
CMD > history
--- Node.js Internal History ---
[ 'history', 'ask' ]
------------------------------
CMD > 

Suggested Core Fix:
Add a skipHistory option to prevent storage:

rl.question('Password? ', { skipHistory: true }, (pw) => {
  console.log(rl.history); // ✅ Input is excluded
});

[edmundoego67-web]

Version

v20.19.4, v22.18.0, v24.5.0

Platform

Microsoft Windows NT 10.0.26100.0 x64

Docker Desktop: 

* node:current-alpine
* node:lts-alpine
* node:20-alpine
* node:20

Subsystem

readline

What steps will reproduce the bug?

// file.js
const readline = require("node:readline");

const rl = readline.createInterface({
input: process.stdin,
output: process.stdout,
prompt: "CMD > ",
});

console.log('Type "history" to see Node.js internal history.');
rl.prompt();

rl.on("line", (line) => {
const cmd = line.trim().toLowerCase();

if (cmd === "ask") {
rl.question("Enter secret (not in history): ", (answer) => {
console.log(> Secret was "${answer}".);
rl.prompt();
});
} else if (cmd === "history") {
console.log("--- Node.js Internal History ---");
console.log(rl.history);
console.log("------------------------------");
rl.prompt();
} else if (cmd === "exit") {
rl.close();
} else {
console.log(> Command was "${cmd}");
rl.prompt();
}
});

rl.on("close", () => process.exit(0));
Run node test.js.

Enter the following commands in sequence:

1. ask
2. my-secret (when prompted)
3. history

How often does it reproduce? Is there a required condition?

Every time.

What is the expected behavior? Why is that the expected behavior?

[ 'history', 'ask' ]

The my-secret input to the question should be excluded.

What do you see instead?

[ 'history', 'my-secret', 'ask' ]

Additional information

No response

[github-actions]

This issue has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.