russell@unturf.com 1edc2f5a93 squid: 2 defects (squid-0002 CWE-407, squid-0003 CWE-312); MOADs 0002/0003/0005 CLEAN

MOAD-0001 squid-0002: HttpHeader::removeConnectionHeaderEntries() O(H*C) per response hop.
strListIsMember() scans all C Connection tokens for each of H header entries. Fix: pre-build
unordered_set from Connection tokens once, probe O(1) per entry. 4.84x measured speedup at
H=200 headers / C=50 Connection tokens. Called per hop in removeHopByHopEntries().

MOAD-0004 squid-0003: CWE-312 credentials logged verbatim in debug output.
FtpGateway.cc loginParser() logs user:password at debug 9; basic/Config.cc decodeCleartext()
logs decoded cleartext at debug 9 AND logs full Authorization header at DBG_IMPORTANT (level 1,
always on); basic/UserRequest.cc startHelperLookup() logs user:password at debug 9.
Fix: replace credential values with redacted markers / length-only diagnostic info.

MOAD-0002: SquidConfig 571-line god object in 209 files, 1408 call sites — structural,
documented in defects/squid/scan/MOAD-RESULTS.md.
MOAD-0003: CLEAN (event-loop single-threaded, no thread_local for request context).
MOAD-0005: CLEAN (event-loop single-threaded, no concurrent cache race).

2026-03-31 19:55:05 -04:00

2.4 KiB

Raw Blame History

Squid All-5-MOAD Scan Results

Scanned: squid-cache/squid (depth=1, 2026-03-31)

MOAD-0001 (CWE-407): O(N²) list membership

squid-0001 (pre-existing): NotePairs::appendNewOnly O(S*E) — hasPair() scan inside entry loop. Fixed in defects/squid-0001.

squid-0002 (new): HttpHeader::removeConnectionHeaderEntries() O(H*C) — strListIsMember() inside getEntry() loop. Called per response hop in removeHopByHopEntries(). At H=200 headers and C=50 Connection tokens: 4.84x measured speedup. Fixed in defects/squid-0002.

MOAD-0002 (Intertangle): god object coupling

SquidConfig is a 571-line god object included in 209 source files across every subsystem: ACL, auth, TLS/SSL, cache, networking, ICAP/eCAP, delay pools, logging, DNS, FTP. Config.* is called 1408 times across the codebase. Every subsystem reads global Config directly with no interface boundary. This is classic Intertangle — changing any field risks ripple effects across all 209 consumers. Not patchable in isolation; requires architectural decomposition into subsystem-scoped config structs with clean interfaces.

Severity: HIGH (structural, long-term technical debt). Not assigned a defect dir — scope is too large for a single patch.

MOAD-0003 (Leaked Context): thread_local request-scoped identity

CLEAN. Squid is a single-threaded event-loop process (one worker per CPU, no shared request state across threads). No thread_local holding request-scoped identity found. The async ACL checklist and callback model handles request context explicitly without thread-local storage.

MOAD-0004 (CWE-312): credentials logged verbatim

squid-0003 (new): Three callsites log plaintext credentials to cache.log:

FtpGateway.cc loginParser(): logs full login=user:password and password= at debug 9
auth/basic/Config.cc decodeCleartext(): logs decoded cleartext (user:pass) at debug 9; logs raw Authorization header at DBG_IMPORTANT (level 1, always logged!) when bad chars detected
auth/basic/UserRequest.cc startHelperLookup(): logs "user:password" at debug 9

The DBG_IMPORTANT site is especially severe — it fires without any debug_options tuning. Fixed in defects/squid-0003.

MOAD-0005 (Thundering Herd): unsynchronized cache

CLEAN. Squid uses an event-driven single-threaded worker model. Cache operations (ipcache, fqdncache, store) are non-concurrent within a worker. The ssl_ctx_cache uses a single-threaded LRU. No get+null+compute+put race condition applies.

2.4 KiB Raw Blame History