3 commits

Author	SHA1	Message	Date
russell@unturf.com	5f0585ef76	squid: 5-MOAD scan complete; add TICKET.md for squid-0001/0002/0003, mark SCAN-TODO done ... All 4 squid defects confirmed: squid-0001 CWE-407 NotePairs::appendNewOnly hasPair O(S*D) 374x; squid-0002 CWE-407 removeConnectionHeaderEntries strListIsMember O(H*C) 3x; squid-0003 CWE-312 FTP+Basic auth passwords logged verbatim incl DBG_IMPORTANT; squid-0004 CWE-407 whichPeer() O(P*A) ICP peer map 83x. MOAD-0002 SquidConfig god-object documented (structural). MOAD-0003/0005 CLEAN. All 4 unit tests PASS.	2026-04-03 14:58:20 -04:00
russell@unturf.com	93c9c175d4	undf: assign UNDF-2026-000001125 to mercurial-0001, stamp patches	2026-04-03 11:04:23 -04:00
russell@unturf.com	1edc2f5a93	squid: 2 defects (squid-0002 CWE-407, squid-0003 CWE-312); MOADs 0002/0003/0005 CLEAN ... MOAD-0001 squid-0002: HttpHeader::removeConnectionHeaderEntries() O(H*C) per response hop. strListIsMember() scans all C Connection tokens for each of H header entries. Fix: pre-build unordered_set from Connection tokens once, probe O(1) per entry. 4.84x measured speedup at H=200 headers / C=50 Connection tokens. Called per hop in removeHopByHopEntries(). MOAD-0004 squid-0003: CWE-312 credentials logged verbatim in debug output. FtpGateway.cc loginParser() logs user:password at debug 9; basic/Config.cc decodeCleartext() logs decoded cleartext at debug 9 AND logs full Authorization header at DBG_IMPORTANT (level 1, always on); basic/UserRequest.cc startHelperLookup() logs user:password at debug 9. Fix: replace credential values with redacted markers / length-only diagnostic info. MOAD-0002: SquidConfig 571-line god object in 209 files, 1408 call sites — structural, documented in defects/squid/scan/MOAD-RESULTS.md. MOAD-0003: CLEAN (event-loop single-threaded, no thread_local for request context). MOAD-0005: CLEAN (event-loop single-threaded, no concurrent cache race).	2026-03-31 19:55:05 -04:00