java-topology/defects/wine-0002/patch/wine-0002-basic-auth-credential-trace-leak.patch

13 lines
900 B
Diff

# UNDF: UNDF-2026-000001193
--- a/dlls/wininet/http.c
+++ b/dlls/wininet/http.c
@@ -787,7 +787,10 @@ static void cache_basic_authorization(LPWSTR host, LPWSTR realm, LPSTR auth_data
TRACE("caching authorization for %s:%s = %s\n",debugstr_w(host),debugstr_w(realm),debugstr_an(auth_data,auth_data_len));
+ /* DEFECT (CWE-312): auth_data is "username:password" in plain UTF-8.
+ * Logging it verbatim via TRACE exposes credentials to any process
+ * or log collector that captures Wine debug output (WINEDEBUG=+wininet).
+ * Replace with a redacted marker so host+realm are still traceable. */
- TRACE("caching authorization for %s:%s = %s\n",debugstr_w(host),debugstr_w(realm),debugstr_an(auth_data,auth_data_len));
+ TRACE("caching authorization for %s:%s = <redacted, len=%u>\n",debugstr_w(host),debugstr_w(realm),auth_data_len);
EnterCriticalSection(&authcache_cs);