28 lines
1.7 KiB
Diff
28 lines
1.7 KiB
Diff
# UNDF: UNDF-2026-000001080
|
|
# UNDF: (leave blank)
|
|
# CWE-312: Cleartext Storage of Sensitive Information — OAuth2 client secret logged verbatim
|
|
# Severity: HIGH
|
|
# File: core/libs/dplugins/webservices/o2/src/o2.cpp
|
|
# Function: O2::onVerificationReceived (GrantFlowAuthorizationCode branch)
|
|
# Pattern: After building the token exchange POST body (which includes clientSecret_),
|
|
# the full QByteArray data is printed unconditionally via qDebug().
|
|
# Any user with Qt debug logging enabled (QT_LOGGING_RULES=* or debug build)
|
|
# will have their OAuth2 client secret written to stderr / log files in plaintext.
|
|
# This affects all digiKam cloud service plugins using OAuth2:
|
|
# Google Photos, Flickr, OneDrive/Skydrive, etc.
|
|
# Fix: remove the debug log of the full request body, or redact the client_secret field.
|
|
# Note: line 347 already truncates token values to 3 chars as a best practice —
|
|
# apply same discipline here.
|
|
|
|
--- a/core/libs/dplugins/webservices/o2/src/o2.cpp
|
|
+++ b/core/libs/dplugins/webservices/o2/src/o2.cpp
|
|
@@ -280,9 +280,8 @@ void O2::onVerificationReceived(const QMap<QString, QString> response) {
|
|
parameters.insert(O2_OAUTH2_CLIENT_SECRET, clientSecret_);
|
|
parameters.insert(O2_OAUTH2_REDIRECT_URI, redirectUri_);
|
|
parameters.insert(O2_OAUTH2_GRANT_TYPE, O2_AUTHORIZATION_CODE);
|
|
QByteArray data = buildRequestBody(parameters);
|
|
|
|
- qDebug() << QString("O2::onVerificationReceived: Exchange access code data:\n%1").arg(QString(data));
|
|
+ qDebug() << "O2::onVerificationReceived: Sending token exchange request (body redacted)";
|
|
|
|
QNetworkReply *tokenReply = manager_->post(tokenRequest, data);
|