russell@unturf.com
223ccb3fee
0ad-0001 CCmpObstructionManager dirty shapes vector+std::find O(N*D) HIGH 4.1x 0ad-0002 CCmpRangeManager m_ModifiedEntities vector+std::find O(E*M) HIGH 25.8x 0ad-0003 CCmpTemplateManager FindUsedTemplates vector+std::find O(T^2) MEDIUM 5.9x 0ad-0004 XmppClient+NetServer lobby auth token logged verbatim CWE-312 MEDIUM MOAD-0002 (Intertangle): g_ globals are deliberate single-thread game arch, CLEAN MOAD-0003 (Leaked Context): thread_local properly scoped, CLEAN MOAD-0005 (Thundering Herd): single-threaded sim, no cache stampede, CLEAN 4/4 unit tests PASS, UNDF 956-959
16 lines
754 B
Diff
16 lines
754 B
Diff
# UNDF: UNDF-2026-000000959
|
|
--- a/source/lobby/XmppClient.cpp
|
|
+++ b/source/lobby/XmppClient.cpp
|
|
@@ -1,5 +1,6 @@
|
|
// CWE-312 (MOAD-0004): Lobby auth tokens logged verbatim, exposing session
|
|
// credentials in log files. Fix: redact token values in log output.
|
|
|
|
@@ -958,7 +959,7 @@
|
|
- LOGMESSAGE("XmppClient: Received lobby auth: %s from %s", lobbyAuth->m_Token.to_string(), iq.from().username());
|
|
+ LOGMESSAGE("XmppClient: Received lobby auth: [REDACTED] from %s", iq.from().username());
|
|
|
|
--- a/source/network/NetServer.cpp
|
|
+++ b/source/network/NetServer.cpp
|
|
@@ -874,7 +874,7 @@
|
|
- LOGMESSAGE("Net Server: Received lobby auth message from %s with %s", name, token);
|
|
+ LOGMESSAGE("Net Server: Received lobby auth message from %s with [REDACTED]", name);
|