russell@unturf.com
1e10775b90
jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
Fix: HashSet for O(1) membership; pre-built index map for indexOf
Unit test: 4/4 PASS, 19-35x op-count reduction at N=200
woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
two nested loops over items and deps: O(N*D*N) = O(N^2)
Fix: pre-build name-set map for O(1) lookup, O(N) total
Unit test: 3/3 PASS, 20x op-count reduction at N=100
woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
Exposes full Bearer JWT token in application logs
Fix: log only that header was found, not its value
Unit test: 3/3 PASS
15 lines
744 B
Diff
15 lines
744 B
Diff
diff --git a/shared/token/token.go b/shared/token/token.go
|
|
index abcdef0..1234567 100644
|
|
--- a/shared/token/token.go
|
|
+++ b/shared/token/token.go
|
|
@@ -68,8 +68,8 @@ func ParseRequest(allowedTypes []Type, r *http.Request, fn SecretFunc) (*Token,
|
|
// first we attempt to get the token from the
|
|
// authorization header.
|
|
token := r.Header.Get("Authorization")
|
|
if len(token) != 0 {
|
|
- log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
|
|
+ // CWE-312 fix: do NOT log the Authorization header value — it contains the raw Bearer token.
|
|
+ log.Trace().Msg("token.ParseRequest: found token in Authorization header")
|
|
bearer := token
|
|
if _, err := fmt.Sscanf(token, "Bearer %s", &bearer); err != nil {
|
|
return nil, err
|