Contrib.social

Caught exception leaks creds and doesnt return a failure object

Open on Drupal.org →
Created on 18 April 2023, about 1 year ago
Updated 30 May 2023, about 1 year ago

I wouldn't consider this a security issue as it requires dev-level logging to browser, but could still be problematic.

Problem/Motivation

When a request exception is thrown, for example with a timeout, sometimes a request body is not available, so RequestException->getResponse() is null.

Calling a method like getBody() on null will crash the page, and if you have debug output on, will also leak the password from the \Drupal\crowd\Crowd\CrowdConnector::register parameter.

Though not in scope for this issue and to some extent this issue will resolve it. I'd suggest somehow changing the structure of the code to obfuscate the password so it isnt present in backtrace dumps. Just in case a different bug pops up and causes backtraces to output again.

In modern PHP I'd suggest exclusively utilising the #[SensitiveParameter] attribute, but we don't presently have that luxury. I believe we can use multiline parameters and add this attribute safely for older versions of PHP, though it will not be functional.

Steps to reproduce

Get the request to timeout with a network failure of some kind.

Proposed resolution

Check for getResponse() nullabiltiy.

Remaining tasks

Implement and review

User interface changes

None

API changes

None

Data model changes

None

🐛 Bug report
Status

Fixed

Version

3.0

Component

Code

Created by

🇦🇺Australia dpi Perth, Australia

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024