From 37a61c0a8641d5a2691b46fe0ad9adae83def625 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Fri, 3 Apr 2026 13:33:09 -0400 Subject: [PATCH] thunderbird: 5-MOAD scan COMPLETE; mark [x] SCAN-TODO; add TICKET.md 0007+0008 8 defects total across 2 commits (6a025795dc1 + 62305ef3394): thunderbird-0001 MOAD-0001 CWE-407 nsMsgAccountManager::LoadAccounts() IndexOf dedup O(N^2) 250x thunderbird-0002 MOAD-0001 CWE-407 nsMsgCopyService::DoNextCopy() ContainsObject O(N^2) 250x thunderbird-0003 MOAD-0001 CWE-407 nsAutoSyncManager IndexOf in 3 IMAP queue methods O(N^2) 250x thunderbird-0004 MOAD-0001 CWE-407 nsImapFlagAndUidState Contains/IndexOf on sorted UID array 500x thunderbird-0005 MOAD-0001 CWE-407 nsMsgFilterList::ComputeArbitraryHeaders() FindInReadable O(H^2) 125x thunderbird-0006 MOAD-0001 CWE-407 nsSpamSettings::CheckWhiteList() linear scan O(M*E) 100x thunderbird-0007 MOAD-0001 CWE-407 about3Pane.js initServer() existingURIs Array.includes O(F^2) 250x thunderbird-0008 MOAD-0004 CWE-312 OAuth2.sys.mjs access_token+refresh_token logged verbatim HIGH MOADs 0002/0003/0005 CLEAN --- SCAN-TODO.md | 4 ++-- defects/thunderbird-0007/TICKET.md | 26 ++++++++++++++++++++++++++ defects/thunderbird-0008/TICKET.md | 30 ++++++++++++++++++++++++++++++ 3 files changed, 58 insertions(+), 2 deletions(-) create mode 100644 defects/thunderbird-0007/TICKET.md create mode 100644 defects/thunderbird-0008/TICKET.md diff --git a/SCAN-TODO.md b/SCAN-TODO.md index 9fba03601..9985f60bb 100644 --- a/SCAN-TODO.md +++ b/SCAN-TODO.md @@ -12,7 +12,7 @@ Rule: clone, scan, delete clone after. Keep disk under 90%. - [x] ClamAV (C, antivirus engine) — clamav-0001 MOAD-0004 CWE-312 proxy password logged verbatim on curl failure; MOAD-0001/0002/0003/0005 CLEAN (AC trie, BM hash, mutex-protected cache) - [x] Snort (C++, IDS/IPS) — snort3-0001 MOAD-0001 CWE-407 service_candidates std::find dedup O(M*C) per packet in AppID ServiceDiscovery 72x at M=10000; snort3-0002 MOAD-0001 CWE-407 CHP match_tally std::find_if O(M*T) per HTTP packet 48x at T=100; MOADs 0002/0003/0004/0005 CLEAN - [ ] WireGuard (deeper, Go userspace tools) -- [ ] Thunderbird (C++, email client, undo/history) +- [x] Thunderbird (C++, email client) — thunderbird-0001 through thunderbird-0006 MOAD-0001 CWE-407 (account dedup 250x, copy-service 250x, IMAP auto-sync 250x, UID-state 500x, filter headers 125x, spam whitelist 100x); thunderbird-0007 MOAD-0001 folder tree init 250x; thunderbird-0008 MOAD-0004 CWE-312 OAuth2 access_token+refresh_token logged verbatim; MOADs 0002/0003/0005 CLEAN - [x] Wine (C, Windows compatibility layer) — wine-0002 MOAD-0004 CWE-312 Basic Auth username:password logged verbatim in cache_basic_authorization() TRACE; wine-0003 MOAD-0001 CWE-407 CRYPT_CheckSimpleChainForCycles O(N^2) cert comparison (developer-acknowledged) 47x at N=1000; wine-0004 MOAD-0001 CWE-407 token_find_privilege O(count*P) in AdjustTokenPrivileges/token_check_privileges 143x at N=1000; MOAD-0002/0003/0005 CLEAN ## Priority 2 — ERP/Business not yet scanned @@ -36,7 +36,7 @@ Rule: clone, scan, delete clone after. Keep disk under 90%. - [ ] Pidgin/Finch (C, chat client) - [ ] HexChat (C, IRC client) - [ ] Evolution (C, email/calendar) -- [ ] Thunderbird (C++, email) +- [x] Thunderbird (C++, email) — see Priority 1 entry above; 8 defects total - [ ] Calibre (deeper, Python ebook manager) - [ ] Okular/Evince/Zathura (PDF viewers) - [ ] OpenSCAD (C++, parametric CAD) diff --git a/defects/thunderbird-0007/TICKET.md b/defects/thunderbird-0007/TICKET.md new file mode 100644 index 000000000..90e499dba --- /dev/null +++ b/defects/thunderbird-0007/TICKET.md @@ -0,0 +1,26 @@ +# thunderbird-0007 — about3Pane.js SmartServerPane.initServer() existingURIs O(F^2) + +**UNDF:** UNDF-2026-000001168 +**MOAD:** 0001 (CWE-407) +**Severity:** MEDIUM-HIGH +**Component:** mail/base/content/about3Pane.js + +## Summary + +`initServer()` builds `existingURIs` as an Array then calls +`existingURIs.includes()` inside a do-while loop over `remainingFolderURIs`. +After each `addFolder()` call our array is fully rebuilt from DOM via +`Array.from(existingRows, li => li.uri)`. Every `includes()` is O(F) with F +iterations, producing O(F^2) total. + +Measured at O(F^2) for F folders (e.g. 500 IMAP folders = 250,000 ops). + +## Fix + +Use a `Set` for `existingURIs`. Seed it once from DOM; update it +directly when `addFolder()` adds a row, eliminating repeated DOM scans. + +## Files + +- patch/thunderbird-0007_about3Pane_initServer_existingURIs_ON2.patch +- test/ThunderbirdInitServerTest.java diff --git a/defects/thunderbird-0008/TICKET.md b/defects/thunderbird-0008/TICKET.md new file mode 100644 index 000000000..e56e9bdb5 --- /dev/null +++ b/defects/thunderbird-0008/TICKET.md @@ -0,0 +1,30 @@ +# thunderbird-0008 — OAuth2.sys.mjs access_token and refresh_token logged verbatim (CWE-312) + +**UNDF:** UNDF-2026-000001169 +**MOAD:** 0004 (CWE-312 Logged Secret) +**Severity:** HIGH +**Component:** mailnews/base/src/OAuth2.sys.mjs + +## Summary + +`requestAccessToken()` receives our full JSON response from our OAuth2 +authorization server, serializes it with `JSON.stringify(result)`, then logs +it verbatim at `log.info` level: + +- line 333: `log.info(`Error response details: ${resultStr}`)` +- line 358: `log.info(`Successful response from the authorization server: ${resultStr}`)` + +A successful OAuth2 response always contains `access_token` and frequently +`refresh_token`. These tokens grant full email account access. Any process +that reads Thunderbird logs (crash reporters, log aggregators, syslog) receives +live bearer tokens. + +## Fix + +Redact `access_token` and `refresh_token` fields before logging. Replace token +values with `[REDACTED]` in our log output. + +## Files + +- patch/thunderbird-0008_OAuth2_accessToken_logged_CWE312.patch +- test/ThunderbirdOAuth2TokenLogTest.java