13 lines
900 B
Diff
13 lines
900 B
Diff
# UNDF: UNDF-2026-000001193
|
|
--- a/dlls/wininet/http.c
|
|
+++ b/dlls/wininet/http.c
|
|
@@ -787,7 +787,10 @@ static void cache_basic_authorization(LPWSTR host, LPWSTR realm, LPSTR auth_data
|
|
TRACE("caching authorization for %s:%s = %s\n",debugstr_w(host),debugstr_w(realm),debugstr_an(auth_data,auth_data_len));
|
|
+ /* DEFECT (CWE-312): auth_data is "username:password" in plain UTF-8.
|
|
+ * Logging it verbatim via TRACE exposes credentials to any process
|
|
+ * or log collector that captures Wine debug output (WINEDEBUG=+wininet).
|
|
+ * Replace with a redacted marker so host+realm are still traceable. */
|
|
- TRACE("caching authorization for %s:%s = %s\n",debugstr_w(host),debugstr_w(realm),debugstr_an(auth_data,auth_data_len));
|
|
+ TRACE("caching authorization for %s:%s = <redacted, len=%u>\n",debugstr_w(host),debugstr_w(realm),auth_data_len);
|
|
|
|
EnterCriticalSection(&authcache_cs);
|