Skip to content

Commit

Permalink
fix issues with masking password in debug output
Browse files Browse the repository at this point in the history
  • Loading branch information
@mrbaseman
mrbaseman committed Oct 30, 2023
1 parent 6181a4a commit 924a18b
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions src/http.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,13 +92,14 @@ int http_send(struct tunnel *tunnel, const char *request, ...)
url_encode(password, tunnel->config->password);
pwstart = strstr(logbuffer, password);

if (pwstart != NULL) {
while (pwstart != NULL) {
int pos, pwlen, i;

pos = pwstart - logbuffer;
pwlen = strlen(tunnel->config->password);
pwlen = strlen(password);
for (i = pos; i < pos + pwlen; i++)
logbuffer[i] = '*';
pwstart = strstr(logbuffer, password);
}
}

Expand Down

2 comments on commit 924a18b

@moses-palmer
Copy link

@moses-palmer moses-palmer commented on 924a18b Oct 31, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your quick reply!

This fixes the issue with the password length, but issues with the password being a substring of the request remain: a header log like User-Agent: Mo*****/5.0 gives a clear hint about what the password is.

As you say, however, insufficient masking of passwords in debug logs might not be the most severe of vulnerabilities, and the proper solution would probably require a different signature for http_send, such that the exact position of the actual password string could be deduced.

@DimitriPapadopoulos
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You could write:

		while (pwstart = strstr(logbuffer, password)) {
			...
		}

instead of:

		pwstart = strstr(logbuffer, password);

		while (pwstart != NULL) {
			...
			pwstart = strstr(logbuffer, password);
		}

Otherwise looks good to me.

Please sign in to comment.