22 lines
1,019 B
Diff
22 lines
1,019 B
Diff
# UNDF: UNDF-2026-000001039
|
|
diff --git a/src/libs/tgfclient/webserver.cpp b/src/libs/tgfclient/webserver.cpp
|
|
index 8863236..26d73f7 100644
|
|
--- a/src/libs/tgfclient/webserver.cpp
|
|
+++ b/src/libs/tgfclient/webserver.cpp
|
|
@@ -296,7 +296,15 @@ int WebServer::updateAsyncStatus()
|
|
|
|
int WebServer::addAsyncRequest(const std::string &data)
|
|
{
|
|
- GfLogInfo("WebServer: Performing ASYNC request:\n%s\n", data.c_str());
|
|
+ // CWE-312: Never log request bodies verbatim — they may contain
|
|
+ // credentials. The login request embeds <username> and <password> in
|
|
+ // plain XML, so logging data.c_str() exposes them in the game log file.
|
|
+ // Log only the request size instead.
|
|
+ GfLogInfo("WebServer: Performing ASYNC request (%zu bytes)\n", data.size());
|
|
+#ifdef SD_WEBSERVER_DEBUG_VERBOSE
|
|
+ // Only compiled in explicit debug builds — never in release.
|
|
+ GfLogDebug("WebServer: ASYNC request body:\n%s\n", data.c_str());
|
|
+#endif
|
|
|
|
//read the webserver configuration
|
|
this->readConfiguration();
|