russell@unturf.com
fb090af082
vlc-0003: modules/access/dsm/access.c:585 logs psz_login + psz_domain via msg_Warn() on every successful SMB1 login. VLC debug logs are routinely shared in bug reports, exposing SMB usernames and domain names. Fix: remove our credential log line. 6/6 unit tests PASS. VLC MOADs 0002/0003/0005 CLEAN. Kodi all 5 MOADs CLEAN (CWE-407 previously noted; CServiceBroker + LanguageHookTls documented as architectural debt, no patch warranted).
2.5 KiB
Kodi 5-MOAD Scan — 2026-03-31
Target: https://github.com/xbmc/xbmc (depth=1)
MOAD-0001 (CWE-407) — CLEAN
Kodi uses proper containers (maps, sets, unordered_map.contains()) throughout. Only 11 files use std::find, all on small fixed-size collections:
- VAAPI/DXVA m_freeSurfaces std::find: bounded by decoder surface pool size (typically 16-32 surfaces), inside locked sections. Not O(N^2) at scale.
- MusicInfoScanner thumbs std::find: thumbs is a user-configured list of 3-10 items. Bounded, not hot-path O(N^2).
- WSDiscovery IP dedup: O(N^2) but network discovery is bounded to ~100 devices max. No significant MOAD-0001 defects found.
MOAD-0002 (Intertangle) — ARCHITECTURAL NOTE (no patch)
CServiceBroker is a global service locator exposing 30+ subsystems (addons, PVR, network, video, audio, filesystem, settings, peripherals, etc.). This is a classic god-object / intertangle pattern. However, it is intentional Kodi architecture providing DI-style access without singletons. Patching it would require a multi-year architectural refactor. Documented as architectural debt.
MOAD-0003 (Leaked Context) — ARCHITECTURAL NOTE (no patch)
xbmc/interfaces/legacy/LanguageHook.cpp uses thread_local LanguageHook* addonLanguageHookTls
to carry per-addon-invocation identity (addon ID, version, invoker ID) in our
scripting bridge. This is the MOAD-0003 pattern: request-scoped identity held
in thread-local storage. The LanguageHook.h comment (line 91) even acknowledges
the problem: "I need an InheritableThreadLocal C++ equivalent."
xbmc/interfaces/python/PyContext.cpp uses thread_local PyContextState* for
Python GIL management (not identity leakage per se — GIL state is inherently
per-thread).
The LanguageHook TLS is a true MOAD-0003 site but correcting it requires
replacing all addon callback dispatch with an explicit context parameter.
Documented as architectural debt.
MOAD-0004 (CWE-312) — CLEAN
xbmc/platform/posix/filesystem/SMBFile.cpp redacts credentials in SMB log
messages using std::regex: "(\\w+://)\\S+:\\S+@" replaced with
"$1USERNAME:PASSWORD@". No plaintext credential logging found elsewhere.
CLog searches across xbmc/network/, xbmc/filesystem/ return no password hits.
MOAD-0005 (Thundering Herd) — CLEAN
CVideoThumbLoader::GetArtFromCache() has an unguarded get+insert pattern but CBackgroundInfoLoader runs a single worker thread (std::unique_ptr), so concurrent access to m_artCache is impossible by design. VAAPI/DXVA surface cache operations are all wrapped in std::unique_lock. No concurrent cache stampede found.