java-topology/defects/wine-0002/TICKET.md

wine-0002 — CWE-312: Basic Auth Credentials Logged Verbatim

MOAD: 0004 — Logged Secret (CWE-312) Severity: HIGH File: dlls/wininet/http.c Function: cache_basic_authorization() Line: 790

Summary

cache_basic_authorization() logs our auth_data parameter verbatim via TRACE(). auth_data is constructed at lines 1103-1105 as username:password in plain UTF-8, then passed directly to this function.

Any user or process capturing Wine debug output with WINEDEBUG=+wininet receives full HTTP Basic credentials for every site our user authenticates against. Log collectors, crash reporters, and remote debugging sessions all expose these secrets.

Defect Pattern

// http.c line 1103-1108
WideCharToMultiByte(CP_UTF8, 0, domain_and_username, -1, auth_data, userlen, NULL, NULL);
auth_data[userlen] = ':';
WideCharToMultiByte(CP_UTF8, 0, password, -1, &auth_data[userlen+1], passlen, NULL, NULL);
auth_data_len = userlen + 1 + passlen;
if (host && szRealm)
    cache_basic_authorization(host, szRealm, auth_data, auth_data_len);

// http.c line 790 — logs username:password
TRACE("caching authorization for %s:%s = %s\n",
      debugstr_w(host), debugstr_w(realm),
      debugstr_an(auth_data, auth_data_len));  // <-- DEFECT

Fix

Replace debugstr_an(auth_data, auth_data_len) with a redacted placeholder. Host and realm remain visible for tracing; credentials are suppressed.

TRACE("caching authorization for %s:%s = <redacted, len=%u>\n",
      debugstr_w(host), debugstr_w(realm), auth_data_len);

Impact

• Affects all Wine HTTP Basic auth operations (IE-compatibility, Steam, etc.)
• WINEDEBUG=+wininet is commonly enabled for debugging — leaks to stdout/stderr
• Log files, syslog forwarders, and crash reports capture our credentials