java-topology/defects/linapple-0001/patch/linapple-0001.patch

15 lines
554 B
Diff

# UNDF: UNDF-2026-000001122
# UNDF: UNDF-2026-XXXXXXXXX
--- a/src/Applewin.cpp
+++ b/src/Applewin.cpp
@@ -868,7 +868,12 @@ static void LoadConfiguration(bool registry)
}
// Print some debug strings
- printf("Ready login = %s\n", g_sFTPUserPass);
+ {
+ /* CWE-312: g_sFTPUserPass is "user:password" — never log verbatim. */
+ const char *colon = strchr(g_sFTPUserPass, ':');
+ int user_len = colon ? (int)(colon - g_sFTPUserPass) : (int)strlen(g_sFTPUserPass);
+ printf("Ready login = %.*s:***\n", user_len, g_sFTPUserPass);
+ }
}