Skip to content

fix: show custom error messages when hide_input=True#3321

Closed
MAXDVVV wants to merge 1 commit intopallets:mainfrom
MAXDVVV:fix/hide-input-error-message-2809
Closed

fix: show custom error messages when hide_input=True#3321
MAXDVVV wants to merge 1 commit intopallets:mainfrom
MAXDVVV:fix/hide-input-error-message-2809

Conversation

@MAXDVVV
Copy link
Copy Markdown

@MAXDVVV MAXDVVV commented Apr 6, 2026

Problem

When using hide_input=True with a custom type that raises BadParameter (via self.fail()), the custom error message is swallowed and replaced with a generic "Error: The value you entered was invalid.".

This is because termui.py has an explicit branch that replaces any UsageError message with a hardcoded string when hide_input=True:

except UsageError as e:
    if hide_input:
        echo("Error: The value you entered was invalid.")  # custom message lost!
    else:
        echo(f"Error: {e.message}")  # custom message shown

Reproduction

class StrictPassword(click.ParamType):
    name = "password"
    def convert(self, value, param, ctx):
        if len(value) < 8:
            self.fail("Password must be at least 8 characters", param, ctx)
        return value

@click.command()
@click.option("--pw", prompt=True, hide_input=True, type=StrictPassword())
def cmd(pw): ...

Entering "short" shows: Error: The value you entered was invalid.
Expected: Error: Password must be at least 8 characters

Fix

Remove the hide_input branch in the UsageError handler — always show the actual error message. The hide_input flag should only affect whether the input value is echoed during typing, not whether the developer's custom validation error messages are displayed.

Custom error messages are written by the developer and don't contain the secret input value, so there's no security reason to suppress them.

Test

Added test_hide_input_shows_custom_error — verifies custom error messages from type validation are shown even when hide_input=True.

Fixes #2809

Previously, when hide_input=True and a type's convert() raised a
UsageError (e.g. BadParameter), the custom error message was replaced
with a generic 'Error: The value you entered was invalid.' message.

The hide_input flag should only affect whether the input value is
echoed during typing, not whether custom validation error messages
are displayed. Custom error messages from type validation are written
by the developer and do not contain the secret input value.

Fixes pallets#2809
@davidism davidism closed this Apr 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

@click.Option with 'hide_input' = True (used for password) and custom 'type' parameter doesn't show custom error message.

2 participants