russell@unturf.com
0f711c3996
jicofo (Java Jitsi signaling backend): - jicofo-0001: MOAD-0001 CWE-407 reInviteParticipantsById List.contains O(P x R), 250.5x at P=1000 R=500 HIGH - jicofo-0002: MOAD-0004 CWE-312 YouTube/RTMP stream key logged verbatim at INFO level HIGH - MOADs 0002/0003/0005 CLEAN jitsi-meet frontend (previously scanned, marking done): - 4 MOAD-0001 defects (0001-0004); MOADs 0002/0003/0004/0005 CLEAN llama.cpp (previously scanned, marking done): - llamacpp-0001 MOAD-0001 CWE-407 grammar stacks std::find O(S^2); MOADs 0002/0003/0004/0005 CLEAN Also includes langchain-0002 MOAD-0001 unique_documents O(D^2) from prior session.
77 lines
3.2 KiB
Java
77 lines
3.2 KiB
Java
/**
|
|
* Unit test for jicofo-0002: CWE-312 stream key logged verbatim.
|
|
*
|
|
* Verifies our maskStreamId helper correctly redacts stream keys in log output.
|
|
*/
|
|
public class JicofoStreamKeyMaskTest {
|
|
|
|
// Mirrors our proposed fix in JibriSession
|
|
static String maskStreamId(String id) {
|
|
if (id == null || id.length() <= 4)
|
|
return "****";
|
|
return "****" + id.substring(id.length() - 4);
|
|
}
|
|
|
|
// Simulates our defective log line (original code)
|
|
static String buildLogLineDefective(String streamId) {
|
|
return "Starting Jibri jvb.example.com for stream ID: " + streamId + " in room: testroom";
|
|
}
|
|
|
|
// Simulates our fixed log line
|
|
static String buildLogLineFixed(String streamId) {
|
|
return "Starting Jibri jvb.example.com for stream ID: " + maskStreamId(streamId) + " in room: testroom";
|
|
}
|
|
|
|
static void assertTrue(boolean condition, String msg) {
|
|
if (!condition) {
|
|
System.err.println("FAIL: " + msg);
|
|
System.exit(1);
|
|
}
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
System.out.println("=== jicofo-0002 CWE-312 stream key masking test ===");
|
|
|
|
// Representative YouTube stream key format
|
|
String youtubeKey = "abcd-efgh-ijkl-mnop-qrst";
|
|
String twitchKey = "live_12345678901234567890_xyzXYZ";
|
|
String shortKey = "ab12";
|
|
String nullKey = null;
|
|
|
|
// Verify defective version exposes full key
|
|
String defectiveLine = buildLogLineDefective(youtubeKey);
|
|
assertTrue(defectiveLine.contains(youtubeKey),
|
|
"Defective line should contain full stream key");
|
|
|
|
// Verify fixed version does NOT expose full key
|
|
String fixedLine = buildLogLineFixed(youtubeKey);
|
|
assertTrue(!fixedLine.contains(youtubeKey),
|
|
"Fixed line must not contain full YouTube stream key");
|
|
assertTrue(fixedLine.contains("****qrst"),
|
|
"Fixed line should show last 4 chars with **** prefix");
|
|
|
|
// Test Twitch key
|
|
String fixedTwitch = buildLogLineFixed(twitchKey);
|
|
assertTrue(!fixedTwitch.contains(twitchKey),
|
|
"Fixed line must not contain full Twitch key");
|
|
String expectedTwitchSuffix = "****" + twitchKey.substring(twitchKey.length() - 4);
|
|
assertTrue(fixedTwitch.contains(expectedTwitchSuffix),
|
|
"Fixed line should mask Twitch key: " + fixedTwitch + " expected suffix " + expectedTwitchSuffix);
|
|
|
|
// Test short key
|
|
String maskedShort = maskStreamId(shortKey);
|
|
assertTrue(maskedShort.equals("****"),
|
|
"Short key (<=4 chars) should be fully masked, got: " + maskedShort);
|
|
|
|
// Test null key
|
|
String maskedNull = maskStreamId(nullKey);
|
|
assertTrue(maskedNull.equals("****"),
|
|
"Null key should be fully masked, got: " + maskedNull);
|
|
|
|
System.out.println("YouTube key: " + youtubeKey + " -> " + maskStreamId(youtubeKey));
|
|
System.out.println("Twitch key: " + twitchKey + " -> " + maskStreamId(twitchKey));
|
|
System.out.println("Short key: " + shortKey + " -> " + maskStreamId(shortKey));
|
|
System.out.println("Null key: " + nullKey + " -> " + maskStreamId(nullKey));
|
|
System.out.println("PASS: stream key masking works correctly");
|
|
}
|
|
}
|