68 lines
2.5 KiB
Python
68 lines
2.5 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Unit test for veloren-0002: Auth token and network secret logged verbatim (CWE-312)
|
|
|
|
DEFECT: Three logging sites expose credentials:
|
|
1. server/src/login_provider.rs:188 - logs username_or_token at info! level
|
|
2. server/src/sys/msg/register.rs:140 - logs token_or_username at trace! level
|
|
3. network/src/scheduler.rs:483 - logs network secret (u128) at warn! level
|
|
|
|
FIX: Replace credential values with metadata (token_len) and remove secret
|
|
from attack detection log.
|
|
"""
|
|
|
|
import re
|
|
import os
|
|
import sys
|
|
|
|
VELOREN_ROOT = os.path.expanduser("~/git/veloren")
|
|
|
|
def read_file(path):
|
|
with open(os.path.join(VELOREN_ROOT, path), "r") as f:
|
|
return f.read()
|
|
|
|
|
|
def test_login_provider_logs_token():
|
|
"""login_provider.rs should NOT log the raw token value."""
|
|
src = read_file("server/src/login_provider.rs")
|
|
# The defective line logs ?username_or_token which prints the full token
|
|
matches = re.findall(r'info!\(.*\?username_or_token.*"Validating token"', src)
|
|
assert len(matches) > 0, (
|
|
"DEFECT PRESENT: login_provider.rs logs raw auth token at info! level "
|
|
"(line ~188: info!(?username_or_token, \"Validating token\"))"
|
|
)
|
|
print("PASS login_provider: defect confirmed (raw token logged at info! level)")
|
|
|
|
|
|
def test_register_logs_token():
|
|
"""register.rs should NOT log the raw token value."""
|
|
src = read_file("server/src/sys/msg/register.rs")
|
|
matches = re.findall(r'trace!\(.*\?msg\.token_or_username.*"defer auth lockup"', src)
|
|
assert len(matches) > 0, (
|
|
"DEFECT PRESENT: register.rs logs raw token at trace! level "
|
|
"(line ~140: trace!(?msg.token_or_username, \"defer auth lockup\"))"
|
|
)
|
|
print("PASS register: defect confirmed (raw token logged at trace! level)")
|
|
|
|
|
|
def test_scheduler_logs_secret():
|
|
"""scheduler.rs should NOT log the network secret."""
|
|
src = read_file("network/src/scheduler.rs")
|
|
# Find the warn! block that logs ?secret
|
|
matches = re.findall(r'warn!\([^)]*\?secret[^)]*"Detected incompatible Secret', src, re.DOTALL)
|
|
assert len(matches) > 0, (
|
|
"DEFECT PRESENT: scheduler.rs logs network secret at warn! level "
|
|
"(line ~483: ?secret in warn! macro)"
|
|
)
|
|
print("PASS scheduler: defect confirmed (network secret logged at warn! level)")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
if not os.path.isdir(VELOREN_ROOT):
|
|
print(f"SKIP: {VELOREN_ROOT} not found")
|
|
sys.exit(0)
|
|
|
|
test_login_provider_logs_token()
|
|
test_register_logs_token()
|
|
test_scheduler_logs_secret()
|
|
print("PASS (3/3 defect sites confirmed)")
|