Skip to content

Commit

Permalink
[XrdHttp] Obfuscated potential token leaking during first line parsing
Browse files Browse the repository at this point in the history
If one does a GET /path/to/file.txt?authz=... the authz will be
obfuscated in the logline "Parsing first line:"
  • Loading branch information
ccaffy authored and amadio committed Nov 14, 2024
1 parent d75c7d5 commit 82a3fc0
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions src/XrdHttp/XrdHttpProtocol.cc
Original file line number Diff line number Diff line change
Expand Up @@ -616,11 +616,11 @@ int XrdHttpProtocol::Process(XrdLink *lp) // We ignore the argument here

// Read as many lines as possible into the buffer. An empty line breaks
while ((rc = BuffgetLine(tmpline)) > 0) {
std::string traceLine = tmpline.c_str();
if (TRACING(TRACE_DEBUG)) {
std::string traceLine{tmpline.c_str()};
traceLine = obfuscateAuth(traceLine);
TRACE(DEBUG, " rc:" << rc << " got hdr line: " << traceLine);
}
TRACE(DEBUG, " rc:" << rc << " got hdr line: " << traceLine);
if ((rc == 2) && (tmpline.length() > 1) && (tmpline[rc - 1] == '\n')) {
CurrentReq.headerok = true;
TRACE(DEBUG, " rc:" << rc << " detected header end.");
Expand All @@ -629,7 +629,7 @@ int XrdHttpProtocol::Process(XrdLink *lp) // We ignore the argument here


if (CurrentReq.request == CurrentReq.rtUnset) {
TRACE(DEBUG, " Parsing first line: " << tmpline.c_str());
TRACE(DEBUG, " Parsing first line: " << traceLine.c_str());
int result = CurrentReq.parseFirstLine((char *)tmpline.c_str(), rc);
if (result < 0) {
TRACE(DEBUG, " Parsing of first line failed with " << result);
Expand Down

0 comments on commit 82a3fc0

Please sign in to comment.