russell@unturf.com c13562b619 root-cern+hexchat: 5-MOAD scan; 2 defects + hexchat CLEAN

root-cern-0001: TTreeCache::FillBuffer potentialVetoes std::vector
  O(N²) per basket/branch — replace with std::unordered_set, 9.8x speedup
  (MOAD-0001 CWE-407, tree/tree/src/TTreeCache.cxx)

root-cern-0002: TWebFile::GetFromWeb10 logs full HTTP request including
  Authorization: Basic base64(user:password) at gDebug > 0 (HIGH)
  Also affects TS3WebFile — exposes AWS access key + signature
  (MOAD-0004 CWE-312, net/net/src/TWebFile.cxx)

hexchat: all 5 MOADs CLEAN — binary tree user lookup, single-threaded
  event loop, raw log is ephemeral in-memory widget only

2026-03-31 21:49:50 -04:00

679 B

Raw Permalink Blame History

root-cern-0002 — TWebFile Authorization header logged at gDebug > 0 (MOAD-0004)

Target

ROOT (CERN data analysis framework) — https://github.com/root-project/root

MOAD

MOAD-0004 (CWE-312): Cleartext Storage of Sensitive Information

File

net/net/src/TWebFile.cxx — GetFromWeb10() lines 716–717

Summary

When gDebug > 0, ROOT logs the full HTTP request string including Authorization: Basic base64(user:password) to Info() output. base64 is trivially reversible. Also affects TS3WebFile which logs AWS access keys.

Severity

HIGH

Date

2026-03-31

679 B Raw Permalink Blame History Unescape Escape