java-topology/defects/digikam/patch/digikam-0004-o2-oauth-client-secret-logged.patch

28 lines
1.7 KiB
Diff

# UNDF: UNDF-2026-000001080
# UNDF: (leave blank)
# CWE-312: Cleartext Storage of Sensitive Information — OAuth2 client secret logged verbatim
# Severity: HIGH
# File: core/libs/dplugins/webservices/o2/src/o2.cpp
# Function: O2::onVerificationReceived (GrantFlowAuthorizationCode branch)
# Pattern: After building the token exchange POST body (which includes clientSecret_),
# the full QByteArray data is printed unconditionally via qDebug().
# Any user with Qt debug logging enabled (QT_LOGGING_RULES=* or debug build)
# will have their OAuth2 client secret written to stderr / log files in plaintext.
# This affects all digiKam cloud service plugins using OAuth2:
# Google Photos, Flickr, OneDrive/Skydrive, etc.
# Fix: remove the debug log of the full request body, or redact the client_secret field.
# Note: line 347 already truncates token values to 3 chars as a best practice —
# apply same discipline here.
--- a/core/libs/dplugins/webservices/o2/src/o2.cpp
+++ b/core/libs/dplugins/webservices/o2/src/o2.cpp
@@ -280,9 +280,8 @@ void O2::onVerificationReceived(const QMap<QString, QString> response) {
parameters.insert(O2_OAUTH2_CLIENT_SECRET, clientSecret_);
parameters.insert(O2_OAUTH2_REDIRECT_URI, redirectUri_);
parameters.insert(O2_OAUTH2_GRANT_TYPE, O2_AUTHORIZATION_CODE);
QByteArray data = buildRequestBody(parameters);
- qDebug() << QString("O2::onVerificationReceived: Exchange access code data:\n%1").arg(QString(data));
+ qDebug() << "O2::onVerificationReceived: Sending token exchange request (body redacted)";
QNetworkReply *tokenReply = manager_->post(tokenRequest, data);