16 lines
925 B
Diff
16 lines
925 B
Diff
# UNDF: UNDF-2026-000001099
|
|
--- a/subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c
|
|
+++ b/subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c
|
|
@@ -1998,8 +1998,12 @@ gst_rtspsrc_set_proxy (GstRTSPSrc * rtsp, const gchar * proxy)
|
|
if (rtsp->proxy_user != NULL || rtsp->proxy_passwd != NULL) {
|
|
- GST_LOG_OBJECT (rtsp, "set proxy user/pw from properties: %s:%s",
|
|
- GST_STR_NULL (rtsp->proxy_user), GST_STR_NULL (rtsp->proxy_passwd));
|
|
+ /* CWE-312 fix: never log the proxy password verbatim.
|
|
+ * The original GST_LOG_OBJECT call emitted "user:password" into the
|
|
+ * debug log at GST_LEVEL_LOG (level 9). Any process with
|
|
+ * GST_DEBUG="*:9" set (a common developer practice) would expose the
|
|
+ * HTTP proxy password in plain text. Log only the username. */
|
|
+ GST_LOG_OBJECT (rtsp, "set proxy user from properties: %s",
|
|
+ GST_STR_NULL (rtsp->proxy_user));
|
|
}
|
|
}
|