engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/thunderbird-0008/TICKET.md
russell@unturf.com 37a61c0a86 thunderbird: 5-MOAD scan COMPLETE; mark [x] SCAN-TODO; add TICKET.md 0007+0008 
8 defects total across 2 commits (6a025795dc + 62305ef339):
  thunderbird-0001 MOAD-0001 CWE-407 nsMsgAccountManager::LoadAccounts() IndexOf dedup O(N^2) 250x
  thunderbird-0002 MOAD-0001 CWE-407 nsMsgCopyService::DoNextCopy() ContainsObject O(N^2) 250x
  thunderbird-0003 MOAD-0001 CWE-407 nsAutoSyncManager IndexOf in 3 IMAP queue methods O(N^2) 250x
  thunderbird-0004 MOAD-0001 CWE-407 nsImapFlagAndUidState Contains/IndexOf on sorted UID array 500x
  thunderbird-0005 MOAD-0001 CWE-407 nsMsgFilterList::ComputeArbitraryHeaders() FindInReadable O(H^2) 125x
  thunderbird-0006 MOAD-0001 CWE-407 nsSpamSettings::CheckWhiteList() linear scan O(M*E) 100x
  thunderbird-0007 MOAD-0001 CWE-407 about3Pane.js initServer() existingURIs Array.includes O(F^2) 250x
  thunderbird-0008 MOAD-0004 CWE-312 OAuth2.sys.mjs access_token+refresh_token logged verbatim HIGH
  MOADs 0002/0003/0005 CLEAN
2026-04-03 13:33:09 -04:00

1.1 KiB
Raw Blame History

thunderbird-0008 — OAuth2.sys.mjs access_token and refresh_token logged verbatim (CWE-312)

UNDF: UNDF-2026-000001169 MOAD: 0004 (CWE-312 Logged Secret) Severity: HIGH Component: mailnews/base/src/OAuth2.sys.mjs

Summary

requestAccessToken() receives our full JSON response from our OAuth2 authorization server, serializes it with JSON.stringify(result), then logs it verbatim at log.info level:

  • line 333: log.info(Error response details: ${resultStr})
  • line 358: log.info(Successful response from the authorization server: ${resultStr})

A successful OAuth2 response always contains access_token and frequently refresh_token. These tokens grant full email account access. Any process that reads Thunderbird logs (crash reporters, log aggregators, syslog) receives live bearer tokens.

Fix

Redact access_token and refresh_token fields before logging. Replace token values with [REDACTED] in our log output.

Files

  • patch/thunderbird-0008_OAuth2_accessToken_logged_CWE312.patch
  • test/ThunderbirdOAuth2TokenLogTest.java