russell@unturf.com
223ccb3fee
0ad-0001 CCmpObstructionManager dirty shapes vector+std::find O(N*D) HIGH 4.1x 0ad-0002 CCmpRangeManager m_ModifiedEntities vector+std::find O(E*M) HIGH 25.8x 0ad-0003 CCmpTemplateManager FindUsedTemplates vector+std::find O(T^2) MEDIUM 5.9x 0ad-0004 XmppClient+NetServer lobby auth token logged verbatim CWE-312 MEDIUM MOAD-0002 (Intertangle): g_ globals are deliberate single-thread game arch, CLEAN MOAD-0003 (Leaked Context): thread_local properly scoped, CLEAN MOAD-0005 (Thundering Herd): single-threaded sim, no cache stampede, CLEAN 4/4 unit tests PASS, UNDF 956-959
76 lines
2.3 KiB
C++
76 lines
2.3 KiB
C++
// Unit test for 0ad-0004: Lobby auth token logged verbatim (CWE-312)
|
|
// Verifies that token values are redacted in log messages.
|
|
|
|
#include <cstdio>
|
|
#include <cstring>
|
|
#include <cassert>
|
|
#include <string>
|
|
|
|
// Simulate the LOGMESSAGE pattern from 0 A.D.
|
|
// Before: logs token verbatim
|
|
// After: replaces token with [REDACTED]
|
|
|
|
std::string FormatLogBefore(const char* name, const char* token) {
|
|
char buf[256];
|
|
snprintf(buf, sizeof(buf), "XmppClient: Received lobby auth: %s from %s", token, name);
|
|
return buf;
|
|
}
|
|
|
|
std::string FormatLogAfter(const char* name) {
|
|
char buf[256];
|
|
snprintf(buf, sizeof(buf), "XmppClient: Received lobby auth: [REDACTED] from %s", name);
|
|
return buf;
|
|
}
|
|
|
|
std::string FormatNetLogBefore(const char* name, const char* token) {
|
|
char buf[256];
|
|
snprintf(buf, sizeof(buf), "Net Server: Received lobby auth message from %s with %s", name, token);
|
|
return buf;
|
|
}
|
|
|
|
std::string FormatNetLogAfter(const char* name) {
|
|
char buf[256];
|
|
snprintf(buf, sizeof(buf), "Net Server: Received lobby auth message from %s with [REDACTED]", name);
|
|
return buf;
|
|
}
|
|
|
|
void test_xmpp_redaction() {
|
|
const char* token = "a1b2c3d4e5f6";
|
|
const char* name = "player42";
|
|
|
|
std::string before = FormatLogBefore(name, token);
|
|
std::string after = FormatLogAfter(name);
|
|
|
|
// Before: token appears in log
|
|
assert(before.find(token) != std::string::npos);
|
|
// After: token does NOT appear in log
|
|
assert(after.find(token) == std::string::npos);
|
|
// After: [REDACTED] appears
|
|
assert(after.find("[REDACTED]") != std::string::npos);
|
|
// After: username still present
|
|
assert(after.find(name) != std::string::npos);
|
|
|
|
printf("PASS xmpp_redaction: token removed from log output\n");
|
|
}
|
|
|
|
void test_netserver_redaction() {
|
|
const char* token = "session-token-xyz789";
|
|
const char* name = "hostplayer";
|
|
|
|
std::string before = FormatNetLogBefore(name, token);
|
|
std::string after = FormatNetLogAfter(name);
|
|
|
|
assert(before.find(token) != std::string::npos);
|
|
assert(after.find(token) == std::string::npos);
|
|
assert(after.find("[REDACTED]") != std::string::npos);
|
|
assert(after.find(name) != std::string::npos);
|
|
|
|
printf("PASS netserver_redaction: token removed from log output\n");
|
|
}
|
|
|
|
int main() {
|
|
test_xmpp_redaction();
|
|
test_netserver_redaction();
|
|
printf("ALL TESTS PASSED\n");
|
|
return 0;
|
|
}
|