39 lines
1.9 KiB
Diff
39 lines
1.9 KiB
Diff
# UNDF: UNDF-2026-000001169
|
|
--- a/mailnews/base/src/OAuth2.sys.mjs
|
|
+++ b/mailnews/base/src/OAuth2.sys.mjs
|
|
@@ -318,16 +318,25 @@ MOAD-0004 CWE-312: OAuth2.sys.mjs access_token and refresh_token logged verbatim
|
|
# Severity: HIGH
|
|
# CVE class: CWE-312 Cleartext Storage of Sensitive Information
|
|
#
|
|
# Root cause: requestAccessToken() receives the full JSON response from the OAuth2
|
|
# authorization server, serializes it with JSON.stringify(result) → resultStr, then
|
|
# logs it verbatim at log.info level:
|
|
#
|
|
# line 333: log.info(`Error response details: ${resultStr}`)
|
|
# line 358: log.info(`Successful response from the authorization server: ${resultStr}`)
|
|
#
|
|
# A successful OAuth2 response always contains "access_token" and frequently
|
|
# "refresh_token". When a user or developer sets mailnews.oauth.loglevel to
|
|
# "All", "Debug", or "Info" (common during troubleshooting), these tokens are
|
|
# written to the application log and/or browser console.
|
|
#
|
|
# access_token grants full mailbox access (Gmail, Microsoft 365, Fastmail).
|
|
# refresh_token is long-lived and survives account password changes.
|
|
# Logging either constitutes CWE-312: credentials at rest in plaintext log files.
|
|
#
|
|
# Fix: strip sensitive fields before logging. Redact access_token, refresh_token,
|
|
# and id_token from the result object before calling JSON.stringify.
|
|
|
|
.then(result => {
|
|
- const resultStr = JSON.stringify(result);
|
|
+ // PATCH thunderbird-0008: redact credential fields before logging (CWE-312).
|
|
+ const safeResult = Object.assign({}, result);
|
|
+ for (const field of ["access_token", "refresh_token", "id_token"]) {
|
|
+ if (field in safeResult) {
|
|
+ safeResult[field] = "[redacted]";
|
|
+ }
|
|
+ }
|
|
+ const resultStr = JSON.stringify(safeResult);
|
|
if ("error" in result) {
|
|
// RFC 6749 section 5.2. Error Response
|
|
let err = result.error;
|