java-topology/defects/linapple-0001/SUMMARY.md

linapple-0001: FTP user:password logged verbatim at startup (CWE-312 / MOAD-0004)

Severity: HIGH File: src/Applewin.cpp Function: LoadConfiguration() Line: 871

Description

LoadConfiguration() reads g_sFTPUserPass (format: user:password) from the registry or config file, then immediately prints the entire credential string verbatim to stdout via printf:

// Print some debug strings
printf("Ready login = %s\n", g_sFTPUserPass);

This debug line runs at every startup. Any user who has configured FTP credentials for disk image access (non-anonymous logins) has their password written to the terminal, any log file, shell history replay, or screen recording session.

Fix

Extract only our username portion (up to the first :), mask our password with ***:

{
    /* CWE-312: g_sFTPUserPass is "user:password" — never log verbatim. */
    const char *colon = strchr(g_sFTPUserPass, ':');
    int user_len = colon ? (int)(colon - g_sFTPUserPass) : (int)strlen(g_sFTPUserPass);
    printf("Ready login = %.*s:***\n", user_len, g_sFTPUserPass);
}

MOADs 0001-0005

MOAD	Status
0001 CWE-407	CLEAN — no hot-path O(N^2) linear scan found
0002 Intertangle	CLEAN — global state coupling is expected single-instance emulator design
0003 Leaked Context	CLEAN — no ThreadLocal/thread-scoped identity carriers
0004 CWE-312	DEFECT — FTP password logged verbatim at startup
0005 Thundering Herd	CLEAN — no unsynchronized cache patterns found