bugGNU Wget - Bugs: bug #21089, ftp password is shown in output,...

 
 

bug #21089: ftp password is shown in output, when processing redirect

Submitted by:  None
Submitted on:  Sat 15 Sep 2007 09:25:03 PM UTC  
 
Category: User InterfaceSeverity: 3 - Normal
Priority: 9 - ImmediateStatus: Wont Fix
Privacy: PublicAssigned to: None
Originator Name: dmigOriginator Email: -unavailable-
Open/Closed: ClosedRelease: 1.10.2
Operating System: GNU/LinuxReproducibility: Every Time
Fixed Release: NonePlanned Release: 1.14
Regression: NoneWork Required: 0 - Hours
Patch Included: Yes

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 22 Sep 2008 05:13:26 PM UTC, comment #5:

http://article.gmane.org/gmane.comp.web.wget.general/8335

Micah Cowan <micahcowan>
Fri 12 Sep 2008 08:59:47 PM UTC, comment #4:

I hadn't realized that the password we were failing to hide was not a user-supplied password, but one that the server had actually provided. Unsure whether I actually want to hide that, will discuss on-list.

Micah Cowan <micahcowan>
Tue 01 Jul 2008 10:02:28 AM UTC, comment #3:

A possible solution, patch attached.

Remove the log_printf() in http.c (gethttp()) around line 2102, and print the location once parsed in retr.c (retrieve_url()) around line 738.

Btw, protocol/scheme does not matter, ftp/http/whatever locations were showed as is.

(file #15976)

Saint Xavier <sxav>
Sat 22 Mar 2008 03:52:44 PM UTC, comment #2:

It's not fixed. When wget follow a "Location", it writes that location using escnonprint_uri(), which calls escnonprint_internal() for printing only printable chars. There's no code to hide the password.

For hiding the password we should first parse the URL and then we can use "url_string (..., URL_AUTH_HIDE_PASSWD)".

Saint Xavier <sxav>
Mon 24 Sep 2007 10:31:17 PM UTC, comment #1:

May have been fixed in current dev version?

Micah Cowan <micahcowan>
Sat 15 Sep 2007 09:25:03 PM UTC, original submission:

When being redirected from http url to password-protected ftp url, ftp password is shown in console.
Next, when it starts to download, it replaces password value with 'password' string.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15976:  bug_21089.diff added by sxav (2KiB - application/octet-stream - a possible fix)
file #13955:  wget.log added by None (2KiB - text/x-log - described behaviour example)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by cy6erbr4in (Updated the item)
  • -unavailable- added by sxav (Posted a comment)
  • -unavailable- added by micahcowan (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 20 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 23 Sep 2009 04:38:23 PM UTCmicahcowanOpen/ClosedOpen=>Closed
      StatusNeeds Discussion=>Wont Fix
    Fri 12 Sep 2008 08:59:47 PM UTCmicahcowanSeverity4 - Important=>3 - Normal
      StatusReady For Test=>Needs Discussion
      Planned Release1.12=>1.14
    Fri 12 Sep 2008 06:35:07 PM UTCmicahcowanPriority6=>9 - Immediate
    Sat 30 Aug 2008 12:07:55 PM UTCsxavStatusConfirmed=>Ready For Test
    Thu 21 Aug 2008 11:24:58 PM UTCmicahcowanStatusWorks For Me=>Confirmed
      Assigned tocy6erbr4in=>None
      Patch IncludedNone=>Yes
    Sun 20 Jul 2008 06:40:25 PM UTCsxavStatusIn Progress=>Works For Me
    Tue 01 Jul 2008 10:02:28 AM UTCsxavAttached File-=>Added bug_21089.diff, #15976
    Mon 14 Apr 2008 11:39:16 AM UTCmicahcowanStatusNeeds Discussion=>In Progress
    Mon 14 Apr 2008 11:08:36 AM UTCcy6erbr4inAssigned toNone=>cy6erbr4in
    Sat 22 Mar 2008 08:20:28 PM UTCmicahcowanSeverity3 - Normal=>4 - Important
    Sun 27 Jan 2008 04:14:22 AM UTCmicahcowanPriority5 - Normal=>6
      StatusNone=>Needs Discussion
    Tue 25 Sep 2007 10:56:46 PM UTCmicahcowanWork RequiredNone=>0 - Hours
    Mon 24 Sep 2007 10:31:17 PM UTCmicahcowanPlanned ReleaseNone=>1.12
    Sat 15 Sep 2007 09:25:03 PM UTCNoneAttached File-=>Added wget.log, #13955

    Back to the top


    Powered by Savane 3.1-cleanup1