diff options
| author | Patrick Monnerat <patrick@monnerat.net> | 2022-01-10 11:51:16 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2022-01-10 15:49:25 +0100 |
| commit | b6acbdeb6375c9552fd4b04d5ab38422ed25fbaf (patch) | |
| tree | 278cb0abde13e2c4635343e39d241016299054a8 | |
| parent | 223f26c28a340b36d6bee5a0f32fedd00ef695a9 (diff) | |
| download | curl-b6acbdeb6375c9552fd4b04d5ab38422ed25fbaf.tar.gz | |
curl tool: erase some more sensitive command line arguments
As the ps command may reveal sensitive command line info, obfuscate
options --tlsuser, --tlspasswd, --proxy-tlsuser, --proxy-tlspassword and
--oauth2-bearer arguments.
Reported-by: Stephen Boost <s.booth@epcc.ed.ac.uk>
Closes #7964
| -rw-r--r-- | src/tool_getparam.c | 35 |
1 files changed, 22 insertions, 13 deletions
diff --git a/src/tool_getparam.c b/src/tool_getparam.c index 7abbcc639..223214b0a 100644 --- a/src/tool_getparam.c +++ b/src/tool_getparam.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -669,6 +669,7 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */ break; case 'B': /* OAuth 2.0 bearer token */ GetStr(&config->oauth_bearer, nextarg); + cleanarg(nextarg); config->authtype |= CURLAUTH_BEARER; break; case 'c': /* connect-timeout */ @@ -1617,16 +1618,20 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */ GetStr(&config->crlfile, nextarg); break; case 'k': /* TLS username */ - if(curlinfo->features & CURL_VERSION_TLSAUTH_SRP) - GetStr(&config->tls_username, nextarg); - else + if(!(curlinfo->features & CURL_VERSION_TLSAUTH_SRP)) { + cleanarg(nextarg); return PARAM_LIBCURL_DOESNT_SUPPORT; + } + GetStr(&config->tls_username, nextarg); + cleanarg(nextarg); break; case 'l': /* TLS password */ - if(curlinfo->features & CURL_VERSION_TLSAUTH_SRP) - GetStr(&config->tls_password, nextarg); - else + if(!(curlinfo->features & CURL_VERSION_TLSAUTH_SRP)) { + cleanarg(nextarg); return PARAM_LIBCURL_DOESNT_SUPPORT; + } + GetStr(&config->tls_password, nextarg); + cleanarg(nextarg); break; case 'm': /* TLS authentication type */ if(curlinfo->features & CURL_VERSION_TLSAUTH_SRP) { @@ -1687,17 +1692,21 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */ break; case 'u': /* TLS username for proxy */ - if(curlinfo->features & CURL_VERSION_TLSAUTH_SRP) - GetStr(&config->proxy_tls_username, nextarg); - else + if(!(curlinfo->features & CURL_VERSION_TLSAUTH_SRP)) { + cleanarg(nextarg); return PARAM_LIBCURL_DOESNT_SUPPORT; + } + GetStr(&config->proxy_tls_username, nextarg); + cleanarg(nextarg); break; case 'v': /* TLS password for proxy */ - if(curlinfo->features & CURL_VERSION_TLSAUTH_SRP) - GetStr(&config->proxy_tls_password, nextarg); - else + if(!(curlinfo->features & CURL_VERSION_TLSAUTH_SRP)) { + cleanarg(nextarg); return PARAM_LIBCURL_DOESNT_SUPPORT; + } + GetStr(&config->proxy_tls_password, nextarg); + cleanarg(nextarg); break; case 'w': /* TLS authentication type for proxy */ |