russell@unturf.com
1e10775b90
jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
Fix: HashSet for O(1) membership; pre-built index map for indexOf
Unit test: 4/4 PASS, 19-35x op-count reduction at N=200
woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
two nested loops over items and deps: O(N*D*N) = O(N^2)
Fix: pre-build name-set map for O(1) lookup, O(N) total
Unit test: 3/3 PASS, 20x op-count reduction at N=100
woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
Exposes full Bearer JWT token in application logs
Fix: log only that header was found, not its value
Unit test: 3/3 PASS
36 lines
1.8 KiB
Diff
36 lines
1.8 KiB
Diff
--- a/subsys/net/l2/wifi/wifi_mgmt.c
|
|
+++ b/subsys/net/l2/wifi/wifi_mgmt.c
|
|
@@ -396,9 +396,14 @@ static int wifi_connect(uint64_t mgmt_request, struct net_if *iface,
|
|
# Defect ID: zephyr-0002
|
|
# MOAD: 0004
|
|
# Severity: HIGH
|
|
# CVE class: CWE-312 Cleartext Storage/Exposure of Sensitive Information
|
|
#
|
|
# Root cause: wifi_connect() in wifi_mgmt.c dumps the WiFi PSK and SAE
|
|
# password as raw hex via LOG_HEXDUMP_DBG on every connection attempt:
|
|
#
|
|
# line 396: LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
|
|
# line 397: LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
|
|
# line 399: LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
|
|
#
|
|
# LOG_HEXDUMP_DBG fires at LOG_LEVEL_DBG. When a developer or board BSP sets
|
|
# CONFIG_WIFI_LOG_LEVEL_DBG=y (common during WiFi bring-up and certification
|
|
# testing), the PSK is dumped to the Zephyr logging backend in hex. On boards
|
|
# with RTT, UART, or flash logging backends this exposes the network passphrase
|
|
# in cleartext to anyone with console or log access.
|
|
#
|
|
# The SSID is not a credential and is fine to log. The PSK and SAE password
|
|
# must not appear in logs at any log level.
|
|
#
|
|
# Fix: remove LOG_HEXDUMP_DBG for psk and sae_password. Log only the SSID,
|
|
# channel and security type (already logged by NET_DBG two lines below).
|
|
|
|
LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
|
|
- LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
|
|
- if (params->sae_password) {
|
|
- LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
|
|
- }
|
|
+ /* PATCH zephyr-0002: do not log PSK or SAE password (CWE-312). */
|
|
+ LOG_DBG("psk set: %s", params->psk_length > 0 ? "yes" : "no");
|
|
+ LOG_DBG("sae_password set: %s", (params->sae_password && params->sae_password_length > 0) ? "yes" : "no");
|
|
NET_DBG("ch %u sec %u", params->channel, params->security);
|