`readline` history incorrectly includes input from `rl.question()`

[thedrlambda]

Version

v20.19.4, v22.18.0, v24.5.0

Platform

Microsoft Windows NT 10.0.26100.0 x64

Docker Desktop: 

* node:current-alpine
* node:lts-alpine
* node:20-alpine
* node:20

Subsystem

readline

What steps will reproduce the bug?

// file.js
const readline = require("node:readline");

const rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout,
  prompt: "CMD > ",
});

console.log('Type "history" to see Node.js internal history.');
rl.prompt();

rl.on("line", (line) => {
  const cmd = line.trim().toLowerCase();

  if (cmd === "ask") {
    rl.question("Enter secret (not in history): ", (answer) => {
      console.log(`> Secret was "${answer}".`);
      rl.prompt();
    });
  } else if (cmd === "history") {
    console.log("--- Node.js Internal History ---");
    console.log(rl.history);
    console.log("------------------------------");
    rl.prompt();
  } else if (cmd === "exit") {
    rl.close();
  } else {
    console.log(`> Command was "${cmd}"`);
    rl.prompt();
  }
});

rl.on("close", () => process.exit(0));

Run node test.js.

Enter the following commands in sequence:

1. ask
2. my-secret (when prompted)
3. history

How often does it reproduce? Is there a required condition?

Every time.

What is the expected behavior? Why is that the expected behavior?

[ 'history', 'ask' ]

The my-secret input to the question should be excluded.

What do you see instead?

[ 'history', 'my-secret', 'ask' ]

Additional information

No response

[pckrishnadas88]

You could change this behavior with a temporary fix something like this.

const readline = require("node:readline");

const rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout,
  prompt: "CMD > ",
});

console.log('Type "history" to see Node.js internal history.');
rl.prompt();

rl.on("line", (line) => {
  const cmd = line.trim().toLowerCase();

  if (cmd === "ask") {
    rl.question("Enter secret (not in history): ", (answer) => {
      // Remove the SECOND LAST history entry (secret input)
      if (rl.history.length >= 2) {
        rl.history.splice(rl.history.length - 2, 1); // Remove second last item
      }

      console.log(`> Secret was "${answer}".`);
      rl.prompt();
     
    });
  } else if (cmd === "history") {
    console.log("--- Node.js Internal History ---");
    console.log(rl.history);
    console.log("------------------------------");
    rl.prompt();
  } else if (cmd === "exit") {
    rl.close();
  } else {
    console.log(`> Command was "${cmd}"`);
    rl.prompt();
  }
});

rl.on("close", () => process.exit(0));

Which will result in

Type "history" to see Node.js internal history.
CMD > ask
Enter secret (not in history): my-secret
> Secret was "my-secret".
CMD > history
--- Node.js Internal History ---
[ 'history', 'ask' ]
------------------------------
CMD > 

Suggested Core Fix:
Add a skipHistory option to prevent storage:

rl.question('Password? ', { skipHistory: true }, (pw) => {
  console.log(rl.history); // ✅ Input is excluded
});

[edmundoego67-web]

Version

v20.19.4, v22.18.0, v24.5.0

Platform

Microsoft Windows NT 10.0.26100.0 x64

Docker Desktop: 

* node:current-alpine
* node:lts-alpine
* node:20-alpine
* node:20

Subsystem

readline

What steps will reproduce the bug?

// file.js
const readline = require("node:readline");

const rl = readline.createInterface({
input: process.stdin,
output: process.stdout,
prompt: "CMD > ",
});

console.log('Type "history" to see Node.js internal history.');
rl.prompt();

rl.on("line", (line) => {
const cmd = line.trim().toLowerCase();

if (cmd === "ask") {
rl.question("Enter secret (not in history): ", (answer) => {
console.log(> Secret was "${answer}".);
rl.prompt();
});
} else if (cmd === "history") {
console.log("--- Node.js Internal History ---");
console.log(rl.history);
console.log("------------------------------");
rl.prompt();
} else if (cmd === "exit") {
rl.close();
} else {
console.log(> Command was "${cmd}");
rl.prompt();
}
});

rl.on("close", () => process.exit(0));
Run node test.js.

Enter the following commands in sequence:

1. ask
2. my-secret (when prompted)
3. history

How often does it reproduce? Is there a required condition?

Every time.

What is the expected behavior? Why is that the expected behavior?

[ 'history', 'ask' ]

The my-secret input to the question should be excluded.

What do you see instead?

[ 'history', 'my-secret', 'ask' ]

Additional information

No response