bugGNU Wget - Bugs: bug #23094, Password in HTML output for FTP


bug #23094: Password in HTML output for FTP

Submitter:  Michael Novak <michaelnovak>
Submitted:  Mon 28 Apr 2008 10:12:38 PM UTC
Category:  Program Logic Severity:  3 - Normal
Priority:  5 - Normal Status:  Needs Discussion
Privacy:  Public Assigned to:  michaelnovak
Originator Name:  michaelnovak Open/Closed:  Open
Release:  None Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  1.15 Regression:  None
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup

Sun 11 May 2008 09:40:36 AM UTC, comment #1: 

when you type such a command, people can already see your username and password in process listing.  there is also the fact ftp itself is plain text so anyone on the network can see it.

the wiki faq already shows secure methods for passing the username and password to wget.

Mike Frysinger <vapier>
Mon 28 Apr 2008 10:12:38 PM UTC, original submission:  

When you run the wget command such as 'wget ftp://username:password@domain.com' the resulting html file created for the LIST call shows the password in the file in plain text.

I guess the discussion could be around to either remove the password from the url and have it prompt for the password or leave it in without worrying and allow the user to go back and modify the file if they desire.


Michael Novak <michaelnovak>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by vapier (Posted a comment)
  • -email is unavailable- added by michaelnovak (Submitted the item)
  • -email is unavailable- added by michaelnovak

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-04-28 michaelnovak Assigned toNone michaelnovak
    2008-04-28 michaelnovak Carbon-Copy- Added michaelnovak

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code