russell@unturf.com 5f0585ef76 squid: 5-MOAD scan complete; add TICKET.md for squid-0001/0002/0003, mark SCAN-TODO done

All 4 squid defects confirmed: squid-0001 CWE-407 NotePairs::appendNewOnly hasPair O(S*D)
374x; squid-0002 CWE-407 removeConnectionHeaderEntries strListIsMember O(H*C) 3x; squid-0003
CWE-312 FTP+Basic auth passwords logged verbatim incl DBG_IMPORTANT; squid-0004 CWE-407
whichPeer() O(P*A) ICP peer map 83x. MOAD-0002 SquidConfig god-object documented (structural).
MOAD-0003/0005 CLEAN. All 4 unit tests PASS.

2026-04-03 14:58:20 -04:00

2.1 KiB

Raw Permalink Blame History

squid-0003 — CWE-312 FTP and Basic auth credentials logged verbatim

Target: Squid (squid-cache/squid, depth=1, 2026-03-31) Files: src/clients/FtpGateway.cc, src/auth/basic/Config.cc, src/auth/basic/UserRequest.cc UNDF: UNDF-2026-000001163 Severity: HIGH (one site at DBG_IMPORTANT, logs without any debug tuning) MOAD: 0004 (CWE-312)

Defect

Three callsites log plaintext credentials to cache.log:

Site 1 — FtpGateway.cc loginParser() (debug level 9)

debugs(9, 9, "IN : login=" << login << ", escaped=" << escaped
       << ", user=" << user << ", password=" << password);
// ... later:
debugs(9, 9, "found password=" << pass << " ...");
debugs(9, 9, "OUT: login=" << login << "..., password=" << password);

Full FTP credentials logged at debug level 9 (enabled with debug_options 9,9).

Site 2 — auth/basic/Config.cc decodeCleartext() (DEBUG_IMPORTANT = level 1)

debugs(29, 9, "'" << cleartext << "'");   // decoded user:password
debugs(29, DBG_IMPORTANT, "WARNING: Bad characters in authorization header '"
       << httpAuthHeader << "'");          // raw base64 Authorization: header

Our DBG_IMPORTANT site (section 29, level 1) fires whenever bad characters are detected in a Basic auth header, without any debug_options tuning. The raw Authorization: Basic <base64> value is logged, which decodes trivially to user:password.

Site 3 — auth/basic/UserRequest.cc startHelperLookup() (debug level 9)

debugs(29, 9, "'" << basic_auth->username() << ":" << basic_auth->passwd << "'");

Logs user:password colon-separated at debug level 9.

Fix

Replace all credential values with redacted markers:

[REDACTED] for passwords
[user] for usernames where only context is needed
Log lengths/flags instead of values
DBG_IMPORTANT site: suppress base64 Authorization header entirely

Test

test/SquidCredentialLogTest.java — simulates all three log sites. Confirms: defective path contains s3cr3t!FTP, proxyuser:myP@ssw0rd. Fixed path contains only [REDACTED], lengths, and safe metadata. DBG_IMPORTANT path: verifies base64 header not present in output. PASS.

2.1 KiB Raw Permalink Blame History