# UNDF: UNDF-2026-000001180
# UNDF: UNDF-2026-XXXXXXXXX
--- a/yabause/src/netlink.c
+++ b/yabause/src/netlink.c
@@ -579,10 +579,11 @@ static void NetlinkWriteByte(u32 addr, u8 val)
             else if (NetlinkArea->connectstatus == NL_CONNECTSTATUS_LOGIN1 &&
                      NetlinkArea->modemstate == NL_MODEMSTATE_DATA &&
                      val == 0x0D)
             {
                // Internet login name
                NetlinkArea->connectstatus = NL_CONNECTSTATUS_LOGIN2;
-               NETLINK_LOG("login response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);
+               /* Do not log the login name verbatim — credentials in cleartext (CWE-312). */
+               NETLINK_LOG("login response: [REDACTED %d bytes]", (int)strlen(NetlinkArea->inbuffer+NetlinkArea->inbufferstart));
                NetlinkDoATResponse("\r\npassword:");
                NetlinkUpdateReceivedDataInt();
             }
@@ -588,8 +589,9 @@ static void NetlinkWriteByte(u32 addr, u8 val)
             else if (NetlinkArea->connectstatus == NL_CONNECTSTATUS_LOGIN2 &&
                NetlinkArea->modemstate == NL_MODEMSTATE_DATA &&
                val == 0x0D)
             {
                // Internet password
                NetlinkArea->connectstatus = NL_CONNECTSTATUS_LOGIN3;
-               NETLINK_LOG("password response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);
+               /* Do not log the password verbatim — credentials in cleartext (CWE-312). */
+               NETLINK_LOG("password response: [REDACTED %d bytes]", (int)strlen(NetlinkArea->inbuffer+NetlinkArea->inbufferstart));
                NetlinkDoATResponse("\r\n$");
                NetlinkUpdateReceivedDataInt();
             }

# Defect: yabause-0001
# MOAD: 0004 (CWE-312 — Cleartext Storage of Sensitive Information)
# File: yabause/src/netlink.c
# Function: NetlinkWriteByte
# Lines: 582, 592
#
# Description:
#   The Sega Saturn NetLink modem emulation (yabause/src/netlink.c) handles
#   Saturn online dial-up sessions. During the PPP/shell login handshake the
#   emulator exchanges a username and password with the remote server on behalf
#   of the emulated Saturn game.
#
#   When NETLINK_DEBUG is defined at compile time, two NETLINK_LOG calls write
#   the authentication credentials verbatim into the debug log:
#
#     Line 582: NETLINK_LOG("login response: %s", inbuffer+inbufferstart)
#       -- logs the Saturn internet login name as a cleartext string
#
#     Line 592: NETLINK_LOG("password response: %s", inbuffer+inbufferstart)
#       -- logs the Saturn internet password as a cleartext string
#
#   NETLINK_LOG expands to DebugPrintf(MainLog, ...) which writes to MainLog
#   (a persistent file-backed debug log, see debug.h). Any log file or terminal
#   session that captures NETLINK_DEBUG output will contain the plaintext
#   username and password used to authenticate the Saturn session.
#
# Severity: MEDIUM
#   - Requires NETLINK_DEBUG compile-time flag (debug/developer builds)
#   - Exposes Saturn internet credentials (ISP username + password) in cleartext
#   - Credentials could authenticate a real ISP account if a user tests with
#     real legacy credentials (e.g. Sega Net, NetLink ISP accounts)
#   - Log files written to disk may persist and be included in crash reports
#
# Fix:
#   Replace the verbatim credential string with a redacted placeholder that
#   preserves the diagnostic byte-count without exposing credential content.
#   The fix applies to both the login name log (line 582) and the password
#   log (line 592).
#
# References:
#   - CWE-312: Cleartext Storage of Sensitive Information
#   - NETLINK_LOG macro: yabause/src/debug.h line 65
#   - NL_CONNECTSTATUS states: yabause/src/netlink.h lines 45-47