bugGNU Wget - Bugs: bug #45825, password's exposed during encoding...

 
 

bug #45825: password's exposed during encoding conversion

Submitted by:  None
Submitted on:  Tue 25 Aug 2015 05:59:16 PM UTC  
 
Category: User InterfaceSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: Tim Ruehsen <rockdaboot>
Originator Name: Originator Email: -unavailable-
Open/Closed: ClosedRelease: 1.16
Operating System: NoneReproducibility: Every Time
Fixed Release: NonePlanned Release: None
Regression: YesWork Required: None
Patch Included: Yes

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 26 Aug 2015 08:43:36 AM UTC, comment #1:

Thanks for reporting.

I attached a patch that checks for '@' in both of the strings before printout. Since the printing is just for debugging (ENABLE_DEBUG must be set), I assume that suppressing the output when we have 'false psoitives' does not matter that much.

(file #34732)

Tim Ruehsen <rockdaboot>
Project AdministratorIn charge of this item.
Tue 25 Aug 2015 05:59:16 PM UTC, original submission:

$ read -s p
baz
$ wget https://bar:$p@foo/…
converted 'https://bar:baz@foo/…' (ANSI_X3.4-1968) -> 'https://bar:baz@foo/…' (UTF-8)
--2015-08-25 20:49:48-- https://bar:password*@foo/…
...

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rockdaboot (Updated the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 16 Sep 2015 06:41:11 PM UTCrockdabootOpen/ClosedOpen=>Closed
    Thu 27 Aug 2015 08:07:43 AM UTCrockdabootStatusNone=>Fixed
      Assigned toNone=>rockdaboot
      RegressionNone=>Yes
      Patch IncludedNone=>Yes
    Wed 26 Aug 2015 09:10:22 AM UTCrockdabootAttached File-=>Added 0001-Suppress-debug-output-when-strings-may-contain-passw.patch, #34734
    Wed 26 Aug 2015 09:08:21 AM UTCrockdabootAttached File#34732=>Removed
    Wed 26 Aug 2015 08:43:36 AM UTCrockdabootAttached File-=>Added 0001-Suppress-debug-output-when-strings-may-contain-passw.patch, #34732

    Back to the top


    Powered by Savane 3.1-cleanup1