Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix information leak in the update-traces script

Browse source 
For trace files that require authentication to download, hide
part of the URL in output messages.  This avoids leaking potentially
sensitive info when running tests using a continuous integration
service.
This commit is contained in:
Daniel Thayer 2018-03-21 15:24:29 -05:00
parent 9ee739421b
commit 3584495562
1 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
testing/external/scripts/update-traces vendored
View file

@ -2,7 +2,7 @@
# #
# Downloads all traces as specified in <cwd>/traces.cfg to directory $1. # Downloads all traces as specified in <cwd>/traces.cfg to directory $1.
# #
# traces.cfg must consist of lines of the form "<url> <md5sum>" # traces.cfg must consist of lines of the form "<url> [<http-user>[:<http-password>]]"
if [ "$1" == "" ]; then if [ "$1" == "" ]; then
echo "usage: `basename $0` <traces-directory>" echo "usage: `basename $0` <traces-directory>"
@ -45,11 +45,15 @@ cat $cfg | while read line; do
if [ "$auth" != "" ]; then if [ "$auth" != "" ]; then
auth="-u $auth" auth="-u $auth"
# Hide the hostname and directory names in output messages
safe_url=`echo $url | sed 's#/[A-Za-z].*/#/[hidden]/#'`
else
safe_url=$url
fi fi
# Get the fingerprint file. # Get the fingerprint file.
if ! eval "$proxy curl $auth -fsS --anyauth $url.md5sum -o $fp.tmp"; then if ! eval "$proxy curl $auth -fsS --anyauth $url.md5sum -o $fp.tmp"; then
echo "Error: Could not get $url.md5sum, skipping download." echo "Error: Could not get $safe_url.md5sum, skipping download."
continue continue
fi fi
@ -64,7 +68,7 @@ cat $cfg | while read line; do
fi fi
if [ "$download" = "1" ]; then if [ "$download" = "1" ]; then
echo Getting $url ... echo Getting $safe_url ...
echo echo
eval "$proxy curl $auth -f --anyauth $url -o $file" eval "$proxy curl $auth -f --anyauth $url -o $file"
echo echo