V Mon, 10 Feb 2020 10:12:27 +0100 Stefan Hundhammer <shundham...@suse.de> napsáno:
> On 2020-02-06 19:46, Josef Reidinger wrote: > > Also we should maybe somehow mention that when Y2DEBUG is set to 1, > > then it logs everything including passwords as it logs also on UI > > layer ( by default not enabled ). > > Is this true and tested and confirmed, or is this an urban legend in the > making? > > Careful what information we are spreading; some people might mistake > such a wild guess for serious information. I am pretty sure that the UI > does NOT log any passwords. Never ever. The code doesn't any CONTAIN any > yuiDebug() call, let alone leaking any confidential information, much > less passwords or even single keystrokes. > > https://github.com/libyui/libyui/blob/master/src/YInputField.cc > https://github.com/libyui/libyui-qt/blob/master/src/YQInputField.cc > https://github.com/libyui/libyui-ncurses/blob/master/src/NCInputField.cc > > I also took great care to explicitly NOT log any passwords in the macro > that we write during installation. > > So, where did you see any password information leaked by the UI? I am > very sure that this does not happen. > > > If any other YaST component logs large hashes that may also contain > passwords, that's another matter; but in that case, this is where we > need to fix things. > > > Kind regards Well, issue is that we log values for our UI terms (not in libyui, but when we construct values). So if you have e.g. password for your ftp server ( lets say ftp://user:passw...@myftp.com ) and you open dialog that allows edit this source e.g. packager if you use it for you repos, then you see in logs something like: 2020-02-10 11:52:09 <0> linux-vvcf.privatesite(12906) [ui] YUINamespace.cc(createFunctionCall):1035 overloaded ReplaceWidget, 2@24 2020-02-10 11:52:09 <0> linux-vvcf.privatesite(12906) [Ruby] binary/Yast.cc(ycp_module_call_ycp_function):326 Call ReplaceWidget 2020-02-10 11:52:09 <0> linux-vvcf.privatesite(12906) [Ruby] binary/Yast.cc(ycp_module_call_ycp_function):332 Append parameter `_cwm_tab_contents_rp 2020-02-10 11:52:09 <0> linux-vvcf.privatesite(12906) [Ruby] binary/Yast.cc(ycp_module_call_ycp_function):332 Append parameter `VBox (`Table (`id ("Y2Network::Widgets::InterfacesTable"), `opt (`notify, `immediate), `header ("Název", "IP adresa", "Zařízení", "Poznámka"), [`item (`id ("wlan1"), "QCA6174 802.11ac Wireless Network Adapter", "DHCP", "wlan1", ""), `item (`id ("eth0"), "NetLink BCM57780 Gigabit Ethernet PCIe", "DHCP", "eth0", ""), `item (`id ("wlan0"), "RTL8188EUS 802.11n Wireless Network Adapter", "DHCP", "wlan0", "")]), `RichText (`id ("Y2Network::Widgets::InterfaceDescription"), `opt (), ""), `Left (`HBox (`PushButton (`id ("Y2Network::Widgets::AddInterface"), `opt (), "Přid&at"), `PushButton (`id ("Y2Network::Widgets::EditInterface"), `opt (), "Uprav&it"), `PushButton (`id ("Y2Network::Widgets::DeleteInterface"), `opt (), "Smaza&t")))) and in this part you see that initial values which can contain passwords. So it is not that we log what user type, but we log it when we display it. Josef -- To unsubscribe, e-mail: yast-devel+unsubscr...@opensuse.org To contact the owner, e-mail: yast-devel+ow...@opensuse.org
