russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1.8 KiB

Raw Blame History

rclone — CWE-312 Disclosure Brief (rclone-0004)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Jottacloud backend logs the OAuth client secret in plaintext via fs.Debugf() during device registration.

The Defect

rclone-0004 (PATCHED — MEDIUM): backend/jottacloud/jottacloud.go:282

m.Set(configClientID, deviceRegistration.ClientID)
m.Set(configClientSecret, obscure.MustObscure(deviceRegistration.ClientSecret))
fs.Debugf(nil, "Got clientID %q and clientSecret %q",
    deviceRegistration.ClientID, deviceRegistration.ClientSecret)

The client secret is obscured when stored in configuration but logged in plaintext during device registration. Debug output is commonly captured in log files or terminal scrollback.

Impact

rclone connects to Jottacloud (Norwegian cloud storage provider). The client secret logged during initial device registration grants OAuth token generation capability. Log files shared with support or stored on multi-user systems expose this credential.

The Fix

Suppress the secret value in the debug log:

// Before
fs.Debugf(nil, "Got clientID %q and clientSecret %q", ..., deviceRegistration.ClientSecret)

// After
fs.Debugf(nil, "Got clientID %q (clientSecret suppressed)", deviceRegistration.ClientID)

Patch

Fix available: defects/rclone-0004/patch/jottacloud_secret_log.patch

Single-file patch in jottacloud.go.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (rclone/rclone).
Assess severity — credential exposure during device registration debug logging.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the rclone team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1.8 KiB Raw Blame History