bugGNU Wget - Bugs: bug #20809, Emitting bug-reporting info

 
 

bug #20809: Emitting bug-reporting info

Submitted by:  Micah Cowan <micahcowan>
Submitted on:  Fri 17 Aug 2007 11:33:40 PM UTC  
 
Category: Feature RequestSeverity: 3 - Normal
Priority: 4Status: Confirmed
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Open
Release: NoneOperating System: None
Reproducibility: NoneFixed Release: None
Planned Release: 1.14Regression: None
Work Required: 1 - DaysPatch Included: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 17 Aug 2007 11:33:40 PM UTC, original submission:

See http://www.mail-archive.com/wget%40sunsite.dk/msg09963.html, where Tony Lewis proposes a --bug option. However, my opinion is that most of this functionality can and should be rolled into the current --debug option; it seems to me that the primary purpose of the --debug option is to give as much information as possible, and often for the purpose of sharing with other users; whether knowledgeable friends, the bug tracker, or the Wget mailing list.

Users need a way to ask Wget to emit output suitable for inclusion in a bug report/support request. In particular, this mode should prevent Wget from emitting password info to output by default.

The idea is that wget should substitute some harmless string for the argument to PASS, in URIs that include "user:pass@" authentication info, in the Authorization and Proxy-Authentication HTTP headers when Basic mechanism is used.

It's unclear whether the Authorization header should be obfuscated when Digest or similar methods are being used; perhaps we should do that as well, to be safe, as the combination of knowing what the nonce is, and what the digest value is, could allow an attacker to brute-force simple passwords.

Other ideas Tony submitted were that it would spit out the command line and rc settings, which are currently left out by debug; and allowing the user to specify a file to which this output is copied (but the info can still appear on the terminal as well).

If we include source-file-specific revision information in the wget binary, we'd probably also want to include that.

The password-obfuscating bit, wrt HTTP headers, at least, would require some reworking of how we do HTTP headers. We'd probably want to keep and emit a list of "headers-to-emit", rather than appending stuff to a buffer we'll be sending, and include the ability to flag specific headers as needing obfuscation, so we submit one version to the server, and another version to the user in our debug output.

Micah Cowan <micahcowan>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by micahcowan (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 21 Aug 2008 11:20:53 PM UTCmicahcowanPlanned Release1.12=>1.14
    Tue 22 Apr 2008 10:55:58 PM UTCmicahcowanWork RequiredNone=>1 - Days
    Sun 27 Jan 2008 04:45:25 AM UTCmicahcowanPriority5 - Normal=>4
      Planned Release1.15=>1.12

    Back to the top


    Powered by Savane 3.1-cleanup1