Window layout persisted in state.json even if window persistence not enabled #21648

Closed
opened 2026-01-31 07:50:53 +00:00 by claunia · 4 comments
Owner

Originally created by @ianjoneill on GitHub (May 8, 2024).

Windows Terminal version

1.20.11215.0

Windows build number

10.0.22631.3447

Other Software

No response

Steps to reproduce

  1. Ensure window persistence is turned off
  2. Set windows terminal as your default terminal application
  3. Go to run and type cmd /k echo hello world
  4. Close the terminal
  5. Inspect %LOCALAPPDATA%\Packages\Microsoft.WindowsTerminalPreview_8wekyb3d8bbwe\LocalState\state.json

Expected Behavior

There is no history of the command that I ran in state.json.

Actual Behavior

state.json has leaked my super secret command line invocation!

{
  "persistedWindowLayouts" : 
  [
    {
      "initialPosition" : "234,234",
      "initialSize" : 
      {
        "height" : 436.0,
        "width" : 873.0
      },
      "launchMode" : "default",
      "tabLayout" : 
      [
        {
          "action" : "newTab",
          "commandline" : "\"C:\\WINDOWS\\system32\\cmd.exe\" /k echo hello world",
          "profile" : "Command Prompt",
          "startingDirectory" : "C:\\Users\\Ian",
          "suppressApplicationTitle" : false,
          "tabTitle" : "C:\\WINDOWS\\system32\\cmd.exe"
        }
      ]
    }
  ],
  "settingsHash" : "190f05f1cd1315b4-01d98faa8aecd332"
}

This is not reproducible on version 1.19.11213.0.

Originally created by @ianjoneill on GitHub (May 8, 2024). ### Windows Terminal version 1.20.11215.0 ### Windows build number 10.0.22631.3447 ### Other Software _No response_ ### Steps to reproduce 1. Ensure window persistence is turned off 2. Set windows terminal as your default terminal application 3. Go to run and type `cmd /k echo hello world` 4. Close the terminal 5. Inspect `%LOCALAPPDATA%\Packages\Microsoft.WindowsTerminalPreview_8wekyb3d8bbwe\LocalState\state.json` ### Expected Behavior There is no history of the command that I ran in `state.json`. ### Actual Behavior `state.json` has leaked my super secret command line invocation! ```json { "persistedWindowLayouts" : [ { "initialPosition" : "234,234", "initialSize" : { "height" : 436.0, "width" : 873.0 }, "launchMode" : "default", "tabLayout" : [ { "action" : "newTab", "commandline" : "\"C:\\WINDOWS\\system32\\cmd.exe\" /k echo hello world", "profile" : "Command Prompt", "startingDirectory" : "C:\\Users\\Ian", "suppressApplicationTitle" : false, "tabTitle" : "C:\\WINDOWS\\system32\\cmd.exe" } ] } ], "settingsHash" : "190f05f1cd1315b4-01d98faa8aecd332" } ``` This is not reproducible on version 1.19.11213.0.
Author
Owner

@lhecker commented on GitHub (May 8, 2024):

Oh dear... But #17206 was created a little earlier than this issue, so lets close it in favor of the older one. 🙂 /dup #17206

@lhecker commented on GitHub (May 8, 2024): Oh dear... But #17206 was created a little earlier than this issue, so lets close it in favor of the older one. 🙂 /dup #17206
Author
Owner

@microsoft-github-policy-service[bot] commented on GitHub (May 8, 2024):

Hi! We've identified this issue as a duplicate of another one that already exists on this Issue Tracker. This specific instance is being closed in favor of tracking the concern over on the referenced thread. Thanks for your report!

@microsoft-github-policy-service[bot] commented on GitHub (May 8, 2024): Hi! We've identified this issue as a duplicate of another one that already exists on this Issue Tracker. This specific instance is being closed in favor of tracking the concern over on the referenced thread. Thanks for your report! <!-- Policy app identification https://img.shields.io/static/v1?label=PullRequestIssueManagement. -->
Author
Owner

@ianjoneill commented on GitHub (May 8, 2024):

I figured they were related, but not quite the same, so opened a separate ticket - given that this pre-dates 1.21.

@ianjoneill commented on GitHub (May 8, 2024): I figured they were related, but not quite the same, so opened a separate ticket - given that this pre-dates 1.21.
Author
Owner

@lhecker commented on GitHub (May 8, 2024):

Oof, I saw the title, read the repro steps, and considering the timing I thought it would be a dupe. I'm sorry. 😣 However, it is in fact the exact same underlying reason: 1.20 contains the same session persistence improvements that 1.21 got, but without the buffer restore code. This is why both 1.20 and 1.21 have the same bug: They persist, even when they shouldn't.

I'll mark #17211 as fixing this issue. We'll then backport the parts that are relevant for 1.20 (a single if condition basically).

@lhecker commented on GitHub (May 8, 2024): Oof, I saw the title, read the repro steps, and considering the timing I thought it would be a dupe. I'm sorry. 😣 However, it is in fact the exact same underlying reason: 1.20 contains the same session persistence improvements that 1.21 got, but without the buffer restore code. This is why both 1.20 and 1.21 have the same bug: They persist, even when they shouldn't. I'll mark #17211 as fixing this issue. We'll then backport the parts that are relevant for 1.20 (a single if condition basically).
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#21648