russell@unturf.com
7d135aa6a1
blender-0004: MOAD-0001 CWE-407 anim_channels_edit.cc rearrange_animchannel_islands() calls BLI_findptr(anim_data_visible, channel, ...) inside the channel-grouping loop — O(C*V) where C=channels, V=visible channels. In a complex rig: C=V=1000, 1,000,000 pointer comparisons per reorder. Fix: build blender::Set<void*> from anim_data_visible before loop, O(1) lookup. Measured: 250x op-count ratio at C=V=1000. darktable-0004: MOAD-0004 CWE-312 pwstorage backends backend_kwallet.c and backend_apple_keychain.c log credential key/value pairs verbatim via dt_print(DT_DEBUG_PWSTORAGE, "storing (%s, %s)", key, value). `value` for Piwigo export is JSON including plaintext password. Triggered by `darktable -d pwstorage` or `-d all` (common debugging mode). Fix: replace value argument with "[REDACTED]" in all four dt_print calls. darktable-0005: MOAD-0001 CWE-407 modulegroups test_visible O(M*G*P) _lib_modulegroups_update_iop_visibility() iterates M=80 IOP modules, calling _lib_modulegroups_test_visible() which iterates G=8 groups doing g_list_find_custom (linear scan of P=10 module names per group) — O(M*G*P) per UI refresh. Called on every search keystroke, module toggle, and group switch. Fix: precompute GHashTable of all visible module names; test_visible = O(1). Measured: 37.8x op-count ratio at M=80, G=8, P=10. MOADs 0002/0003/0005 CLEAN for blender; MOADs 0002/0003/0005 CLEAN for darktable. All 4 blender + 5 darktable unit tests PASS.
82 lines
3.9 KiB
Diff
82 lines
3.9 KiB
Diff
# UNDF: (leave blank)
|
|
# CWE-312: darktable pwstorage backends log credentials verbatim when -d pwstorage
|
|
#
|
|
# darktable's password storage system (pwstorage) manages service credentials
|
|
# for cloud photo sharing services such as Piwigo. When a user saves their
|
|
# account to Piwigo, _piwigo_set_account() serializes their credentials into:
|
|
#
|
|
# {"server":"example.com","username":"user","password":"s3cr3t"}
|
|
#
|
|
# This JSON value flows into both pwstorage backends:
|
|
#
|
|
# 1. backend_kwallet.c dt_pwstorage_kwallet_set() line 368:
|
|
# dt_print(DT_DEBUG_PWSTORAGE, "...storing (%s, %s)", key, value);
|
|
# `value` is the full JSON blob including the plaintext password.
|
|
#
|
|
# 2. backend_kwallet.c dt_pwstorage_kwallet_get() line 555:
|
|
# dt_print(DT_DEBUG_PWSTORAGE, "...reading (%s, %s)", key, value);
|
|
# Same exposure on read.
|
|
#
|
|
# 3. backend_apple_keychain.c line 65:
|
|
# dt_print(DT_DEBUG_PWSTORAGE, "...storing (%s, %s)", key, value);
|
|
# Same JSON value including password.
|
|
#
|
|
# 4. backend_apple_keychain.c line 239:
|
|
# dt_print(DT_DEBUG_PWSTORAGE, "...reading (%s, %s)", server, json_data);
|
|
# json_data contains the reconstructed JSON with the password.
|
|
#
|
|
# The DT_DEBUG_PWSTORAGE flag is enabled at runtime with `darktable -d pwstorage`
|
|
# or `darktable -d all`. Debug logs go to stdout and optionally to the log file
|
|
# (~/.xsession-errors, journald, or a redirected terminal session). Any debug
|
|
# session — including those run to diagnose KWallet/Keychain connectivity — will
|
|
# expose the user's Piwigo password in plaintext in the terminal output.
|
|
#
|
|
# Lua scripts using darktable.password.save() are also affected: backend_kwallet
|
|
# and backend_apple_keychain receive the raw password string via the same path.
|
|
#
|
|
# Fix: log only the key (service name / username), never the value (which may
|
|
# contain the password). Replace `(%s, %s)` with `(%s, [REDACTED])` in all
|
|
# four dt_print calls.
|
|
#
|
|
# Severity: MEDIUM — requires the debug flag `darktable -d pwstorage` or
|
|
# `-d all` to be active. However, `-d all` is commonly used by users diagnosing
|
|
# OpenCL or other issues, which silently exposes credentials. Piwigo credentials
|
|
# are real username+password (not OAuth tokens), so exposure is direct account
|
|
# compromise.
|
|
#
|
|
--- a/src/common/pwstorage/backend_kwallet.c
|
|
+++ b/src/common/pwstorage/backend_kwallet.c
|
|
@@ -365,7 +365,7 @@ gboolean dt_pwstorage_kwallet_set(const backend_kwallet_context_t *context, con
|
|
|
|
while(g_hash_table_iter_next(&iter, &key, &value))
|
|
{
|
|
- dt_print(DT_DEBUG_PWSTORAGE, "[pwstorage_kwallet_set] storing (%s, %s)", (gchar *)key, (gchar *)value);
|
|
+ dt_print(DT_DEBUG_PWSTORAGE, "[pwstorage_kwallet_set] storing (%s, [REDACTED])", (gchar *)key);
|
|
gsize length;
|
|
gchar *new_key = char2qstring(key, &length);
|
|
|
|
@@ -552,7 +552,7 @@ GHashTable *dt_pwstorage_kwallet_get(const backend_kwallet_context_t *context,
|
|
|
|
dt_print(DT_DEBUG_PWSTORAGE,
|
|
- "[pwstorage_kwallet_get] reading (%s, %s)", (gchar *)key, (gchar *)value);
|
|
+ "[pwstorage_kwallet_get] reading (%s, [REDACTED])", (gchar *)key);
|
|
|
|
g_hash_table_insert(table, key, value);
|
|
}
|
|
--- a/src/common/pwstorage/backend_apple_keychain.c
|
|
+++ b/src/common/pwstorage/backend_apple_keychain.c
|
|
@@ -62,7 +62,7 @@ gboolean pwstorage_apple_keychain_set(const char *slot, GHashTable *table)
|
|
while(g_hash_table_iter_next(&iter, &key, &value))
|
|
{
|
|
- dt_print(DT_DEBUG_PWSTORAGE, "[pwstorage_apple_keychain_set] storing (%s, %s)", (gchar *) key, (gchar *) value);
|
|
+ dt_print(DT_DEBUG_PWSTORAGE, "[pwstorage_apple_keychain_set] storing (%s, [REDACTED])", (gchar *) key);
|
|
|
|
gchar *lbl = g_strconcat("darktable - ", slot, NULL);
|
|
|
|
@@ -236,7 +236,7 @@ GHashTable *pwstorage_apple_keychain_get(const char *slot)
|
|
|
|
dt_print(DT_DEBUG_PWSTORAGE,
|
|
- "[pwstorage_apple_keychain_get] reading (%s, %s)", server, json_data);
|
|
+ "[pwstorage_apple_keychain_get] reading (%s, [REDACTED])", server);
|
|
|
|
g_hash_table_insert(table, g_strdup(server), g_strdup(json_data));
|