russell@unturf.com
1edc2f5a93
MOAD-0001 squid-0002: HttpHeader::removeConnectionHeaderEntries() O(H*C) per response hop. strListIsMember() scans all C Connection tokens for each of H header entries. Fix: pre-build unordered_set from Connection tokens once, probe O(1) per entry. 4.84x measured speedup at H=200 headers / C=50 Connection tokens. Called per hop in removeHopByHopEntries(). MOAD-0004 squid-0003: CWE-312 credentials logged verbatim in debug output. FtpGateway.cc loginParser() logs user:password at debug 9; basic/Config.cc decodeCleartext() logs decoded cleartext at debug 9 AND logs full Authorization header at DBG_IMPORTANT (level 1, always on); basic/UserRequest.cc startHelperLookup() logs user:password at debug 9. Fix: replace credential values with redacted markers / length-only diagnostic info. MOAD-0002: SquidConfig 571-line god object in 209 files, 1408 call sites — structural, documented in defects/squid/scan/MOAD-RESULTS.md. MOAD-0003: CLEAN (event-loop single-threaded, no thread_local for request context). MOAD-0005: CLEAN (event-loop single-threaded, no concurrent cache race).
71 lines
3.4 KiB
Diff
71 lines
3.4 KiB
Diff
--- a/src/clients/FtpGateway.cc
|
|
+++ b/src/clients/FtpGateway.cc
|
|
@@ -399,13 +399,13 @@ void
|
|
Ftp::Gateway::loginParser(const SBuf &login, bool escaped)
|
|
{
|
|
debugs(9, 4, "login=" << login << ", escaped=" << escaped);
|
|
- debugs(9, 9, "IN : login=" << login << ", escaped=" << escaped << ", user=" << user << ", password=" << password);
|
|
+ debugs(9, 9, "IN : login=[REDACTED], escaped=" << escaped << ", user=[user], password=[REDACTED]");
|
|
|
|
if (login.isEmpty())
|
|
return;
|
|
|
|
if (!login[0]) {
|
|
debugs(9, 2, "WARNING: Ignoring FTP credentials that start with a NUL character");
|
|
return;
|
|
}
|
|
|
|
@@ -427,13 +427,13 @@ Ftp::Gateway::loginParser(const SBuf &login, bool escaped)
|
|
if (escaped)
|
|
rfc1738_unescape(user);
|
|
- debugs(9, 9, "found user=" << user << " (" << strlen(user) << ") unescaped.");
|
|
+ debugs(9, 9, "found user (length " << strlen(user) << ") unescaped.");
|
|
}
|
|
|
|
if (colonPos != SBuf::npos) {
|
|
const SBuf pass = login.substr(colonPos+1, SBuf::npos);
|
|
SBuf::size_type upto = pass.copy(password, sizeof(password)-1);
|
|
password[upto]='\0';
|
|
- debugs(9, 9, "found password=" << pass << " " <<
|
|
- (upto != pass.length() ? ", truncated-to=" : ", length=") << upto <<
|
|
- ", escaped=" << escaped);
|
|
+ debugs(9, 9, "found password (length=" << pass.length() << ", truncated=" <<
|
|
+ (upto != pass.length() ? "yes" : "no") << ", escaped=" << escaped << ")");
|
|
if (escaped) {
|
|
rfc1738_unescape(password);
|
|
password_url = 1;
|
|
}
|
|
- debugs(9, 9, "found password=" << password << " (" << strlen(password) << ") unescaped.");
|
|
+ debugs(9, 9, "found password (unescaped length=" << strlen(password) << ")");
|
|
}
|
|
|
|
- debugs(9, 9, "OUT: login=" << login << ", escaped=" << escaped << ", user=" << user << ", password=" << password);
|
|
+ debugs(9, 9, "OUT: login=[REDACTED], escaped=" << escaped);
|
|
}
|
|
|
|
--- a/src/auth/basic/Config.cc
|
|
+++ b/src/auth/basic/Config.cc
|
|
@@ -184,10 +184,10 @@ Auth::Basic::Config::decodeCleartext(const char *httpAuthHeader, const HttpReque
|
|
/*
|
|
* Don't allow NL or CR in the credentials.
|
|
*/
|
|
- debugs(29, 9, "'" << cleartext << "'");
|
|
+ debugs(29, 9, "decoded basic credentials (length " << strlen(cleartext) << ")");
|
|
|
|
if (strcspn(cleartext, "\r\n") != strlen(cleartext)) {
|
|
- debugs(29, DBG_IMPORTANT, "WARNING: Bad characters in authorization header '" << httpAuthHeader << "'");
|
|
+ debugs(29, DBG_IMPORTANT, "WARNING: Bad characters in Basic authorization header (base64 header suppressed for security)");
|
|
safe_free(cleartext);
|
|
}
|
|
} else {
|
|
- debugs(29, 2, "WARNING: Invalid Base64 character in authorization header '" << httpAuthHeader << "'");
|
|
+ debugs(29, 2, "WARNING: Invalid Base64 character in Basic authorization header (base64 header suppressed for security)");
|
|
safe_free(cleartext);
|
|
}
|
|
|
|
--- a/src/auth/basic/UserRequest.cc
|
|
+++ b/src/auth/basic/UserRequest.cc
|
|
@@ -102,7 +102,7 @@ Auth::Basic::UserRequest::startHelperLookup(HttpRequest *request, AccessLogEntry
|
|
assert(basic_auth != nullptr);
|
|
- debugs(29, 9, "'" << basic_auth->username() << ":" << basic_auth->passwd << "'");
|
|
+ debugs(29, 9, "looking up basic auth user '" << basic_auth->username() << "' (password suppressed)");
|