onebeyond/rascal

LoggableUrl Leaks partial passwords

Closed this issue · 4 comments

matt1097 commented

The Regex for loggableUrl can leak passwords if the password has a @ in it.
Here: https://github.com/guidesmiths/rascal/blob/2dbe72abce8386eee8762e421ed4b49fbee0c5fc/lib/config/configure.js#L88

This regex matches the first @ found, when it needs to match the last @ found.

For example if the password was "badp@ssword", the log would log: http://user:***@ssword@url instead of the expected http://user:***@url

image

cressie176 commented

Thanks @matt1097, will resolve

cressie176 commented

Fixed in rascal@14.4.5

cressie176 commented

Something strange with the tag. Double checking the fix was published

cressie176 commented

Yep, all good. Thanks again for reporting