Terminal cursor hidden after audit failure

[tysonclugg]

Bug description

After a failed audit, the terminal cursor remains hidden rather than being restored to a visible state. This makes it difficult to use the terminal, unless the cursor is restored with the reset command (which has the downside of clearing the scrollback buffer) or through other more esoteric means (eg: echo -en "\e[?25h").

Reproduction steps

Using the BASH shell:

$ pip-audit -r <(echo django==3.2.12) # terminal cursor is currently visible
Found 2 known vulnerabilities in 1 package
Name   Version ID             Fix Versions
------ ------- -------------- -------------------
django 3.2.12  PYSEC-2022-190 2.2.28,3.2.13,4.0.4
django 3.2.12  PYSEC-2022-191 2.2.28,3.2.13,4.0.4
$ # terminal cursor is now hidden

Expected behavior

The cursor should either remain visible, or be restored to it's visible state after the command completes.

Platform information

• OS name and version:

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.4 LTS
Release:        20.04
Codename:       focal

• pip-audit version (pip-audit -V): pip-audit 2.3.0
• Python version (python -V or python3 -V): Python 3.8.10
• pip version (pip -V or pip3 -V): pip 22.1 from /home/<redacted>/.venv/lib/python3.8/site-packages/pip (python 3.8)

[tysonclugg]

Further testing shows this happens in the VS Code terminal, but not when using Gnome Terminal.

$ gnome-terminal --version
# GNOME Terminal 3.36.2 using VTE 0.60.3 +BIDI +GNUTLS +ICU +SYSTEMD
$ code --version
1.67.1
da15b6fd3ef856477bf6f4fb29ba1b7af717770d
x64

I'm happy to push this to the VS Code issues if appropriate.

EDIT: I should have used my own test case, the bug occurs in both VS Code and Gnome Terminal.

[woodruffw]

Thanks for the report, and for listing the terminals!

I can't reproduce this locally (alacritty 0.10.1 (2844606)), but there's a good chance both Gnome Terminal and VS Code's terminal do things differently. I'll look into it today.

[woodruffw]

Just from a quick look: this is probably a consequence of us overriding progress's finalization behavior, which includes:

    def finish(self):
        if self.file and self.is_tty():
            print(file=self.file)
            if self._hidden_cursor:
                print(SHOW_CURSOR, end='', file=self.file)
                self._hidden_cursor = False

I'm not sure why this doesn't cause problems on alacritty, so that's strange. But either way, we should definitely be revealing the cursor on our end as well.

[woodruffw]

Okay, I think I figured it out -- this is probably a small behavioral difference between versions of CPython. On my local machine (Python 3.10), __del__ is seemingly called when the spinner's context manager exits, which progress uses to reveal the cursor if it isn't already revealed. When I override __del__, I get the same invisible cursor that you do.

My guess is that older versions of CPython (3.8 at least) don't explicitly del the context object after its context exits, so __del__ never gets fired.

[woodruffw]

@tysonclugg I've opened #281 with a potential fix. Could you give the changes on that branch a try and let me know if they work for you?

[tysonclugg]

@woodruffw Yes, that's fixed it for me. Thanks!

[tysonclugg]

I'm not sure why this doesn't cause problems on alacritty, so that's strange. But either way, we should definitely be revealing the cursor on our end as well.

Your prompt may include a control sequence that ensures the cursor is visible, which would mask the problem. I'm considering doing exactly this myself...

[woodruffw]

Thanks for confirming! We'll have a patch release out for this today.

[woodruffw]

Released with 2.3.1.