diff options
author | Michał Górny <mgorny@gentoo.org> | 2019-04-05 19:13:34 +0200 |
---|---|---|
committer | Michał Górny <mgorny@gentoo.org> | 2019-04-05 19:13:45 +0200 |
commit | e0e0415382f55c1c392facd407a21555b6b55c8c (patch) | |
tree | 47408c32425c99054f52454d16fb00db3bb1ee4c /net-misc/aria2/files | |
parent | dev-lang/php: Revbump with new security patches (diff) | |
download | gentoo-e0e0415382f55c1c392facd407a21555b6b55c8c.tar.gz gentoo-e0e0415382f55c1c392facd407a21555b6b55c8c.tar.bz2 gentoo-e0e0415382f55c1c392facd407a21555b6b55c8c.zip |
net-misc/aria2: Backport the fix for CVE-2019-3500
Backport fix for potential password leakage in logs (CVE-2019-3500).
Ideally this would be a fresh snapshot but autoreconf fails on aria2
git.
Bug: https://bugs.gentoo.org/674622
Signed-off-by: Michał Górny <mgorny@gentoo.org>
Diffstat (limited to 'net-misc/aria2/files')
-rw-r--r-- | net-misc/aria2/files/aria2-1.34.0-mask-headers.patch | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/net-misc/aria2/files/aria2-1.34.0-mask-headers.patch b/net-misc/aria2/files/aria2-1.34.0-mask-headers.patch new file mode 100644 index 000000000000..694681d88859 --- /dev/null +++ b/net-misc/aria2/files/aria2-1.34.0-mask-headers.patch @@ -0,0 +1,46 @@ +From 37368130ca7de5491a75fd18a20c5c5cc641824a Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> +Date: Sat, 5 Jan 2019 09:32:40 +0900 +Subject: [PATCH] Mask headers + +--- + src/HttpConnection.cc | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/src/HttpConnection.cc b/src/HttpConnection.cc +index 77cb9d27a..be5b97723 100644 +--- a/src/HttpConnection.cc ++++ b/src/HttpConnection.cc +@@ -102,11 +102,17 @@ std::string HttpConnection::eraseConfidentialInfo(const std::string& request) + std::string result; + std::string line; + while (getline(istr, line)) { +- if (util::startsWith(line, "Authorization: Basic")) { +- result += "Authorization: Basic ********\n"; ++ if (util::istartsWith(line, "Authorization: ")) { ++ result += "Authorization: <snip>\n"; + } +- else if (util::startsWith(line, "Proxy-Authorization: Basic")) { +- result += "Proxy-Authorization: Basic ********\n"; ++ else if (util::istartsWith(line, "Proxy-Authorization: ")) { ++ result += "Proxy-Authorization: <snip>\n"; ++ } ++ else if (util::istartsWith(line, "Cookie: ")) { ++ result += "Cookie: <snip>\n"; ++ } ++ else if (util::istartsWith(line, "Set-Cookie: ")) { ++ result += "Set-Cookie: <snip>\n"; + } + else { + result += line; +@@ -154,8 +160,8 @@ std::unique_ptr<HttpResponse> HttpConnection::receiveResponse() + const auto& proc = outstandingHttpRequests_.front()->getHttpHeaderProcessor(); + if (proc->parse(socketRecvBuffer_->getBuffer(), + socketRecvBuffer_->getBufferLength())) { +- A2_LOG_INFO( +- fmt(MSG_RECEIVE_RESPONSE, cuid_, proc->getHeaderString().c_str())); ++ A2_LOG_INFO(fmt(MSG_RECEIVE_RESPONSE, cuid_, ++ eraseConfidentialInfo(proc->getHeaderString()).c_str())); + auto result = proc->getResult(); + if (result->getStatusCode() / 100 == 1) { + socketRecvBuffer_->drain(proc->getLastBytesProcessed()); |