russell@unturf.com
1e10775b90
jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
Fix: HashSet for O(1) membership; pre-built index map for indexOf
Unit test: 4/4 PASS, 19-35x op-count reduction at N=200
woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
two nested loops over items and deps: O(N*D*N) = O(N^2)
Fix: pre-build name-set map for O(1) lookup, O(N) total
Unit test: 3/3 PASS, 20x op-count reduction at N=100
woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
Exposes full Bearer JWT token in application logs
Fix: log only that header was found, not its value
Unit test: 3/3 PASS
58 lines
2.7 KiB
Diff
58 lines
2.7 KiB
Diff
--- a/subsys/net/lib/wifi_credentials/wifi_credentials_shell.c
|
|
+++ b/subsys/net/lib/wifi_credentials/wifi_credentials_shell.c
|
|
@@ -49,17 +49,17 @@ static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
|
|
# Defect ID: zephyr-0001
|
|
# MOAD: 0004
|
|
# Severity: HIGH
|
|
# CVE class: CWE-312 Cleartext Storage/Exposure of Sensitive Information
|
|
#
|
|
# Root cause: print_network_info() in wifi_credentials_shell.c retrieves stored
|
|
# WiFi credentials and prints the plaintext PSK/password unconditionally via
|
|
# shell_fprintf when the "wifi cred list" shell command is run:
|
|
#
|
|
# line 57-59: shell_fprintf(sh, ..., ", password: \"%.*s\", password_len: %d",
|
|
# ..., creds.password, creds.password_len)
|
|
#
|
|
# For WPA2-PSK, WPA2-PSK-SHA256, SAE, and WPA-PSK security types the password
|
|
# is emitted verbatim to the shell. Additionally for EAP-TLS enterprise mode:
|
|
#
|
|
# line 65-68: shell_fprintf(sh, ..., ", key_passwd: \"%.*s\"...",
|
|
# ..., creds.header.key_passwd, ...)
|
|
#
|
|
# This exposes the private-key passphrase for enterprise TLS connections.
|
|
#
|
|
# On embedded systems with serial console or UART shell, any observer with
|
|
# console access sees live credentials. On boards with logging backends that
|
|
# write to flash or network syslog the credential is persisted in cleartext.
|
|
#
|
|
# Fix: replace the password and key_passwd fields with a redacted marker
|
|
# ("[redacted]") when printing via the shell. The password_len is still
|
|
# printed so the operator can verify a credential is set without exposing value.
|
|
|
|
+static const char REDACTED[] = "[redacted]";
|
|
+
|
|
static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
|
|
{
|
|
int ret = 0;
|
|
@@ -53,12 +53,12 @@ static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
|
|
if (creds.header.type == WIFI_SECURITY_TYPE_PSK ||
|
|
creds.header.type == WIFI_SECURITY_TYPE_PSK_SHA256 ||
|
|
creds.header.type == WIFI_SECURITY_TYPE_SAE ||
|
|
creds.header.type == WIFI_SECURITY_TYPE_WPA_PSK) {
|
|
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
|
|
- ", password: \"%.*s\", password_len: %d", (int)creds.password_len,
|
|
- creds.password, creds.password_len);
|
|
+ ", password: %s, password_len: %d",
|
|
+ REDACTED, creds.password_len);
|
|
}
|
|
|
|
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
|
|
if (creds.header.type == WIFI_SECURITY_TYPE_EAP_TLS) {
|
|
if (creds.header.key_passwd_length > 0) {
|
|
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
|
|
- ", key_passwd: \"%.*s\", key_passwd_len: %d",
|
|
- creds.header.key_passwd_length, creds.header.key_passwd,
|
|
- creds.header.key_passwd_length);
|
|
+ ", key_passwd: %s, key_passwd_len: %d",
|
|
+ REDACTED, creds.header.key_passwd_length);
|
|
}
|