72 lines
3.4 KiB
Diff
72 lines
3.4 KiB
Diff
# UNDF: UNDF-2026-000001163
|
|
--- a/src/clients/FtpGateway.cc
|
|
+++ b/src/clients/FtpGateway.cc
|
|
@@ -399,13 +399,13 @@ void
|
|
Ftp::Gateway::loginParser(const SBuf &login, bool escaped)
|
|
{
|
|
debugs(9, 4, "login=" << login << ", escaped=" << escaped);
|
|
- debugs(9, 9, "IN : login=" << login << ", escaped=" << escaped << ", user=" << user << ", password=" << password);
|
|
+ debugs(9, 9, "IN : login=[REDACTED], escaped=" << escaped << ", user=[user], password=[REDACTED]");
|
|
|
|
if (login.isEmpty())
|
|
return;
|
|
|
|
if (!login[0]) {
|
|
debugs(9, 2, "WARNING: Ignoring FTP credentials that start with a NUL character");
|
|
return;
|
|
}
|
|
|
|
@@ -427,13 +427,13 @@ Ftp::Gateway::loginParser(const SBuf &login, bool escaped)
|
|
if (escaped)
|
|
rfc1738_unescape(user);
|
|
- debugs(9, 9, "found user=" << user << " (" << strlen(user) << ") unescaped.");
|
|
+ debugs(9, 9, "found user (length " << strlen(user) << ") unescaped.");
|
|
}
|
|
|
|
if (colonPos != SBuf::npos) {
|
|
const SBuf pass = login.substr(colonPos+1, SBuf::npos);
|
|
SBuf::size_type upto = pass.copy(password, sizeof(password)-1);
|
|
password[upto]='\0';
|
|
- debugs(9, 9, "found password=" << pass << " " <<
|
|
- (upto != pass.length() ? ", truncated-to=" : ", length=") << upto <<
|
|
- ", escaped=" << escaped);
|
|
+ debugs(9, 9, "found password (length=" << pass.length() << ", truncated=" <<
|
|
+ (upto != pass.length() ? "yes" : "no") << ", escaped=" << escaped << ")");
|
|
if (escaped) {
|
|
rfc1738_unescape(password);
|
|
password_url = 1;
|
|
}
|
|
- debugs(9, 9, "found password=" << password << " (" << strlen(password) << ") unescaped.");
|
|
+ debugs(9, 9, "found password (unescaped length=" << strlen(password) << ")");
|
|
}
|
|
|
|
- debugs(9, 9, "OUT: login=" << login << ", escaped=" << escaped << ", user=" << user << ", password=" << password);
|
|
+ debugs(9, 9, "OUT: login=[REDACTED], escaped=" << escaped);
|
|
}
|
|
|
|
--- a/src/auth/basic/Config.cc
|
|
+++ b/src/auth/basic/Config.cc
|
|
@@ -184,10 +184,10 @@ Auth::Basic::Config::decodeCleartext(const char *httpAuthHeader, const HttpReque
|
|
/*
|
|
* Don't allow NL or CR in the credentials.
|
|
*/
|
|
- debugs(29, 9, "'" << cleartext << "'");
|
|
+ debugs(29, 9, "decoded basic credentials (length " << strlen(cleartext) << ")");
|
|
|
|
if (strcspn(cleartext, "\r\n") != strlen(cleartext)) {
|
|
- debugs(29, DBG_IMPORTANT, "WARNING: Bad characters in authorization header '" << httpAuthHeader << "'");
|
|
+ debugs(29, DBG_IMPORTANT, "WARNING: Bad characters in Basic authorization header (base64 header suppressed for security)");
|
|
safe_free(cleartext);
|
|
}
|
|
} else {
|
|
- debugs(29, 2, "WARNING: Invalid Base64 character in authorization header '" << httpAuthHeader << "'");
|
|
+ debugs(29, 2, "WARNING: Invalid Base64 character in Basic authorization header (base64 header suppressed for security)");
|
|
safe_free(cleartext);
|
|
}
|
|
|
|
--- a/src/auth/basic/UserRequest.cc
|
|
+++ b/src/auth/basic/UserRequest.cc
|
|
@@ -102,7 +102,7 @@ Auth::Basic::UserRequest::startHelperLookup(HttpRequest *request, AccessLogEntry
|
|
assert(basic_auth != nullptr);
|
|
- debugs(29, 9, "'" << basic_auth->username() << ":" << basic_auth->passwd << "'");
|
|
+ debugs(29, 9, "looking up basic auth user '" << basic_auth->username() << "' (password suppressed)");
|