russell@unturf.com
282282447c
kdenlive: all 5 MOADs scanned. - MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found. - MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation. - MOAD-0003: CLEAN (thread_local is execution guard, not request identity). - MOAD-0004: CLEAN (no credential logging). - MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI widgets read/write the same map from the main thread — data race on project load. Patch: add QMutex, wrap all m_lumacache access sites. audacity: all 5 MOADs scanned. - MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found. - MOAD-0002 through MOAD-0005: CLEAN. 9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).
83 lines
3.1 KiB
Java
83 lines
3.1 KiB
Java
package unit;
|
|
|
|
import java.util.ArrayList;
|
|
import java.util.List;
|
|
|
|
/**
|
|
* CWE-312 unit test: gstreamer-0004 — RTSP proxy password logged verbatim
|
|
*
|
|
* Models gst_rtspsrc_set_proxy() in
|
|
* subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c line 2001:
|
|
*
|
|
* DEFECT:
|
|
* GST_LOG_OBJECT (rtsp, "set proxy user/pw from properties: %s:%s",
|
|
* GST_STR_NULL (rtsp->proxy_user), GST_STR_NULL (rtsp->proxy_passwd));
|
|
*
|
|
* Any process with GST_DEBUG="*:9" set (common during development/debugging)
|
|
* exposes the HTTP proxy password in plain text in the debug log.
|
|
*
|
|
* FIX: log only the username, never the password.
|
|
* GST_LOG_OBJECT (rtsp, "set proxy user from properties: %s",
|
|
* GST_STR_NULL (rtsp->proxy_user));
|
|
*
|
|
* This test verifies:
|
|
* 1. The defective version emits the password into the log buffer.
|
|
* 2. The fixed version does NOT emit the password into the log buffer.
|
|
*/
|
|
public class Gstreamer0004RtspProxyPasswordTest {
|
|
|
|
static List<String> logBuffer = new ArrayList<>();
|
|
|
|
static void gstLogDefective(String user, String passwd) {
|
|
// Mirrors: GST_LOG_OBJECT(rtsp, "set proxy user/pw from properties: %s:%s", user, passwd)
|
|
logBuffer.add(String.format("set proxy user/pw from properties: %s:%s", user, passwd));
|
|
}
|
|
|
|
static void gstLogFixed(String user) {
|
|
// Mirrors: GST_LOG_OBJECT(rtsp, "set proxy user from properties: %s", user)
|
|
logBuffer.add(String.format("set proxy user from properties: %s", user));
|
|
}
|
|
|
|
static boolean logContainsPassword(String password) {
|
|
for (String entry : logBuffer) {
|
|
if (entry.contains(password)) return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
final String USER = "proxyuser";
|
|
final String PASSWORD = "s3cr3tP@ssw0rd";
|
|
|
|
System.out.println("gstreamer-0004 CWE-312 RTSP proxy password logging test");
|
|
|
|
// Test 1: defective version — password appears in log
|
|
logBuffer.clear();
|
|
gstLogDefective(USER, PASSWORD);
|
|
boolean defectExposesPassword = logContainsPassword(PASSWORD);
|
|
|
|
System.out.println(" [defect] log entry: " + logBuffer.get(0));
|
|
System.out.println(" [defect] password in log: " + defectExposesPassword);
|
|
|
|
assert defectExposesPassword :
|
|
"Defective logger should expose password in log — test setup error";
|
|
|
|
// Test 2: fixed version — password does NOT appear in log
|
|
logBuffer.clear();
|
|
gstLogFixed(USER);
|
|
boolean fixExposesPassword = logContainsPassword(PASSWORD);
|
|
|
|
System.out.println(" [fix] log entry: " + logBuffer.get(0));
|
|
System.out.println(" [fix] password in log: " + fixExposesPassword);
|
|
|
|
assert !fixExposesPassword :
|
|
"Fixed logger must not expose password in log";
|
|
|
|
// Test 3: fixed version still logs the username
|
|
boolean fixLogsUser = logBuffer.get(0).contains(USER);
|
|
assert fixLogsUser : "Fixed logger should still log the username";
|
|
|
|
System.out.println(" username still logged: " + fixLogsUser);
|
|
System.out.println("PASS");
|
|
}
|
|
}
|