russell@unturf.com
16a8ba0900
digikam-0003 CWE-407: MetaEngine/DMetadata addToXmpTagStringBag and removeFromXmpTagStringBag call QStringList::contains() inside a loop over existing entries — O(O*N) per image during batch metadata write. Fix: build QSet<QString> before the loop for O(1) lookup. 17x speedup at K=200 keywords (unit test PASS). digikam-0004 CWE-312: O2::onVerificationReceived logs the full OAuth2 token exchange POST body (including client_secret_) via qDebug() at GrantFlowAuthorizationCode completion — exposes cloud service credentials in debug logs/stderr for Google Photos, Flickr, OneDrive integrations. Fix: replace full-body dump with redacted log line. lmms: all 5 MOADs CLEAN — std::find uses are non-hot, contains() calls are on QHash/QMap/QSet, no credential logging, no leaked thread context, no unsynchronized cache access.
27 lines
1.6 KiB
Diff
27 lines
1.6 KiB
Diff
# UNDF: (leave blank)
|
|
# CWE-312: Cleartext Storage of Sensitive Information — OAuth2 client secret logged verbatim
|
|
# Severity: HIGH
|
|
# File: core/libs/dplugins/webservices/o2/src/o2.cpp
|
|
# Function: O2::onVerificationReceived (GrantFlowAuthorizationCode branch)
|
|
# Pattern: After building the token exchange POST body (which includes clientSecret_),
|
|
# the full QByteArray data is printed unconditionally via qDebug().
|
|
# Any user with Qt debug logging enabled (QT_LOGGING_RULES=* or debug build)
|
|
# will have their OAuth2 client secret written to stderr / log files in plaintext.
|
|
# This affects all digiKam cloud service plugins using OAuth2:
|
|
# Google Photos, Flickr, OneDrive/Skydrive, etc.
|
|
# Fix: remove the debug log of the full request body, or redact the client_secret field.
|
|
# Note: line 347 already truncates token values to 3 chars as a best practice —
|
|
# apply same discipline here.
|
|
|
|
--- a/core/libs/dplugins/webservices/o2/src/o2.cpp
|
|
+++ b/core/libs/dplugins/webservices/o2/src/o2.cpp
|
|
@@ -280,9 +280,8 @@ void O2::onVerificationReceived(const QMap<QString, QString> response) {
|
|
parameters.insert(O2_OAUTH2_CLIENT_SECRET, clientSecret_);
|
|
parameters.insert(O2_OAUTH2_REDIRECT_URI, redirectUri_);
|
|
parameters.insert(O2_OAUTH2_GRANT_TYPE, O2_AUTHORIZATION_CODE);
|
|
QByteArray data = buildRequestBody(parameters);
|
|
|
|
- qDebug() << QString("O2::onVerificationReceived: Exchange access code data:\n%1").arg(QString(data));
|
|
+ qDebug() << "O2::onVerificationReceived: Sending token exchange request (body redacted)";
|
|
|
|
QNetworkReply *tokenReply = manager_->post(tokenRequest, data);
|