43 lines
1.3 KiB
Diff
43 lines
1.3 KiB
Diff
# UNDF: UNDF-2026-000001184
|
|
--- a/dnsdbq.c
|
|
+++ b/dnsdbq.c
|
|
@@ -858,8 +858,19 @@ static void
|
|
if (debuglev > 0)
|
|
fprintf(stderr, "conf cmd = '%s'\n", cmd);
|
|
DESTROY(cmd);
|
|
line = NULL;
|
|
n = 0;
|
|
while (getline(&line, &n, f) > 0) {
|
|
char **pp;
|
|
|
|
if (strchr(line, '\n') == NULL) {
|
|
fprintf(stderr, "line too long: '%s'\n", line);
|
|
my_exit(1, cf, NULL);
|
|
}
|
|
- if (debuglev > 0)
|
|
- fprintf(stderr, "conf line: %s", line);
|
|
+ /* CWE-312: never log credential values verbatim.
|
|
+ * Log key name only; redact the value for credential keys. */
|
|
+ if (debuglev > 0) {
|
|
+ char *lp = strdup(line);
|
|
+ char *k = strtok(lp, "\040\012");
|
|
+ int is_cred = (k != NULL) && (
|
|
+ strcmp(k, "apikey") == 0 ||
|
|
+ strcmp(k, "circla") == 0 ||
|
|
+ strcmp(k, "deteque_t") == 0 ||
|
|
+ strcmp(k, "deteque_a") == 0);
|
|
+ if (is_cred)
|
|
+ fprintf(stderr, "conf line: %s [REDACTED]\n", k ? k : "?");
|
|
+ else
|
|
+ fprintf(stderr, "conf line: %s", line);
|
|
+ free(lp);
|
|
+ }
|
|
tok1 = strtok(line, "\040\012");
|
|
@@ -913,7 +924,8 @@ static void
|
|
api_key = strdup(val);
|
|
- if (debuglev > 0)
|
|
- fprintf(stderr, "conf env api_key = '%s'\n", api_key);
|
|
+ /* CWE-312: redact API key in debug output */
|
|
+ if (debuglev > 0)
|
|
+ fprintf(stderr, "conf env api_key = [REDACTED]\n");
|
|
}
|