russell@unturf.com
e123ca2fc8
rbldnsd (C, DNS blocklist server): CLEAN all 5 MOADs
- MOAD-0001 CWE-407: CLEAN — all query paths use sorted arrays + binary search
(ds_dnset_find, ds_ip4set_find, ds_ip4tset_find, ds_generic_find all O(log N))
- MOAD-0002 Intertangle: CLEAN — single-threaded, clear separation of zones/datasets
- MOAD-0003 Leaked Context: CLEAN — no thread-local state, no threading at all
- MOAD-0004 Logged Secret: CLEAN — no credential handling in rbldnsd
- MOAD-0005 Thundering Herd: CLEAN — single-threaded, signal-based reload
dnsdbq (C, pDNS CLI tool, github.com/spamhaus/dnsdbq):
- dnsdbq-0001 MOAD-0004 CWE-312 HIGH: API keys and auth credentials logged
verbatim to stderr when -v (debug) flag is used. Two sites:
(1) dnsdbq.c:862 logs every raw config file line including
"apikey <secret>", "circla user:password", "deteque_t token",
"deteque_a authinfo"
(2) dnsdbq.c:915 logs DNSDB_API_KEY env var verbatim
Fix: redact credential values, log key name + [REDACTED]
pdns-logger (C, PowerDNS logging daemon): CLEAN all 5 MOADs
rdap (Go, RDAP client library): CLEAN all 5 MOADs
42 lines
1.3 KiB
Diff
42 lines
1.3 KiB
Diff
--- a/dnsdbq.c
|
|
+++ b/dnsdbq.c
|
|
@@ -858,8 +858,19 @@ static void
|
|
if (debuglev > 0)
|
|
fprintf(stderr, "conf cmd = '%s'\n", cmd);
|
|
DESTROY(cmd);
|
|
line = NULL;
|
|
n = 0;
|
|
while (getline(&line, &n, f) > 0) {
|
|
char **pp;
|
|
|
|
if (strchr(line, '\n') == NULL) {
|
|
fprintf(stderr, "line too long: '%s'\n", line);
|
|
my_exit(1, cf, NULL);
|
|
}
|
|
- if (debuglev > 0)
|
|
- fprintf(stderr, "conf line: %s", line);
|
|
+ /* CWE-312: never log credential values verbatim.
|
|
+ * Log key name only; redact the value for credential keys. */
|
|
+ if (debuglev > 0) {
|
|
+ char *lp = strdup(line);
|
|
+ char *k = strtok(lp, "\040\012");
|
|
+ int is_cred = (k != NULL) && (
|
|
+ strcmp(k, "apikey") == 0 ||
|
|
+ strcmp(k, "circla") == 0 ||
|
|
+ strcmp(k, "deteque_t") == 0 ||
|
|
+ strcmp(k, "deteque_a") == 0);
|
|
+ if (is_cred)
|
|
+ fprintf(stderr, "conf line: %s [REDACTED]\n", k ? k : "?");
|
|
+ else
|
|
+ fprintf(stderr, "conf line: %s", line);
|
|
+ free(lp);
|
|
+ }
|
|
tok1 = strtok(line, "\040\012");
|
|
@@ -913,7 +924,8 @@ static void
|
|
api_key = strdup(val);
|
|
- if (debuglev > 0)
|
|
- fprintf(stderr, "conf env api_key = '%s'\n", api_key);
|
|
+ /* CWE-312: redact API key in debug output */
|
|
+ if (debuglev > 0)
|
|
+ fprintf(stderr, "conf env api_key = [REDACTED]\n");
|
|
}
|