Prompt for password when running `files_external:scan`

[xaverdh]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

occ files_external:scan does not ask for password on stdin, and there is no option to make it do so, as far as I can tell.
This is a potential security risk, because on systems without hardened /proc, a simple ps -au will tell any unprivileged user the password that was passed on the command line.

Steps to reproduce

1. install nextcloud with external storage and session credentials
2. try to use the background scan with externally provided passwords
3. realize that anybody with a user account on the machine can read the passwords from /proc

Expected behavior

The scan command should ask for the password on stdin instead.

Nextcloud Server version

32

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

While this is a security concern in some sense, I think it is fine to open a regular issue here, since admins should know that passing a secret on the command line has security implications.