Skip to content

Hide passwords in URLs and -%H headers from the logs #2000

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
xroche wants to merge 12 commits into
base: master
Choose a base branch
from
Open

Hide passwords in URLs and -%H headers from the logs #2000

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
ab90643
Hide login secrets in the -%H header log
xroche Oct 21, 2026
8a1214a
Log a refused cookie without its value
xroche Oct 21, 2026
4ac2e94
Mask URL passwords in hts-log.txt and log no cookie comment text
xroche Oct 21, 2026
6206167
Mask only the URL passwords the engine reads, in an exact-size copy
xroche Oct 21, 2026
9139541
Log addresses without their login instead of rewriting log lines
xroche Oct 21, 2026
a2ad2b0
Hide passwords in URLs and -%H headers from the logs
xroche Oct 21, 2026
24979ac
Mask URL logins in -%H request lines, Referer and data attributes
xroche Oct 21, 2026
62a3124
Mask logins in any URL scheme and in argument messages
xroche Oct 21, 2026
14cd49d
Mask logins in quoted list lines, blank-led links and option messages
xroche Oct 21, 2026
a7d7c69
Hide the passwords and tokens the engine has seen in every log line
xroche Oct 21, 2026
d9e7371
Hide a password only as a login, and a header token anywhere
xroche Oct 21, 2026
5c66d7f
Mask a password after a user part holding an @, and keep cookie value…
xroche Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
351 changes: 201 additions & 150 deletions src/htsback.c
View file
Open in desktop

Large diffs are not rendered by default.

12 changes: 8 additions & 4 deletions src/htsbauth.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -688,8 +688,7 @@ static hts_boolean cookie_flat_pair(httrackp *opt, t_cookie *cookie, char *pair,
if (eq == NULL || eq == pair) {
if (cookie_flat_ignore(ignored))
hts_log_print(opt, LOG_WARNING,
"Cookies: ignoring a cookie with no name in %s: %.64s",
given, pair);
"Cookies: ignoring a cookie with no name in %s", given);
return HTS_FALSE;
}
*eq = '\0';
Expand Down Expand Up @@ -941,6 +940,7 @@ int cookie_load_from(httrackp *opt, t_cookie *cookie, const char *fpath,
char BIGSTK line[8192];
const size_t line_max = 8000;
hts_boolean first_line = HTS_TRUE;
int lineno = 0;
// this load's records alone, so a line repeating one is caught
t_cookie *seen = (t_cookie *) calloct(1, sizeof(t_cookie));

Expand All @@ -958,6 +958,8 @@ int cookie_load_from(httrackp *opt, t_cookie *cookie, const char *fpath,

// len counts what the buffer cut too, so this catches that line
cookie_readline(fp, line, sizeof(line), &len);
if (lineno < INT_MAX)
lineno++;
if (first_line && len >= sizeof(cookie_bom) - 1 &&
strncmp(line, cookie_bom, sizeof(cookie_bom) - 1) == 0) {
len -= sizeof(cookie_bom) - 1;
Expand Down Expand Up @@ -987,9 +989,11 @@ int cookie_load_from(httrackp *opt, t_cookie *cookie, const char *fpath,

if (rec[0] == '#') {
if (!cookie_known_comment(rec)) {
// no line text, because any part of it can hold a cookie value
hts_log_print(opt, LOG_WARNING,
"Cookies: ignoring an unknown comment in %s: %.64s",
given, rec);
"Cookies: ignoring an unknown comment on line %d "
"of %s",
lineno, given);
refused++;
}
} else {
Expand Down
41 changes: 22 additions & 19 deletions src/htscache.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,16 +53,18 @@ Please visit our Website: http://www.httrack.com
void cache_mayadd(httrackp * opt, cache_back * cache, htsblk * r,
const char *url_adr, const char *url_fil,
const char *url_save) {
hts_log_print(opt, LOG_DEBUG, "File checked by cache: %s", url_adr);
hts_log_print(opt, LOG_DEBUG, "File checked by cache: %s",
adr_nologin(opt, url_adr));
// ---stockage en cache---
// stocker dans le cache?
if (opt->cache) {
if (cache_writable(cache)) {
// ensure not a temporary filename (should not happend ?!)
if (IS_DELAYED_EXT(url_save)) {
hts_log_print(opt, LOG_WARNING,
"aborted cache validation: %s%s still has temporary name %s",
url_adr, url_fil, url_save);
hts_log_print(
opt, LOG_WARNING,
"aborted cache validation: %s%s still has temporary name %s",
adr_nologin(opt, url_adr), url_fil, url_save);
return;
}
// c'est le seul endroit ou l'on ajoute des elements dans le cache (fichier entier ou header)
Expand Down Expand Up @@ -105,9 +107,9 @@ void cache_mayadd(httrackp * opt, cache_back * cache, htsblk * r,
strcatbuff(tempo, "\n");
strcatbuff(tempo, r->location);
}
hts_log_print(opt, LOG_DEBUG,
"Cached fast-header response: %s%s is %d",
url_adr, url_fil, (int) r->statuscode);
hts_log_print(
opt, LOG_DEBUG, "Cached fast-header response: %s%s is %d",
adr_nologin(opt, url_adr), url_fil, (int) r->statuscode);
coucal_add(cache->cached_tests,
concat(OPT_GET_BUFF(opt), OPT_GET_BUFF_SIZE(opt), url_adr, url_fil),
(intptr_t) strdupt(tempo));
Expand Down Expand Up @@ -207,9 +209,10 @@ static void cache_zip_write_failed(httrackp *opt, cache_back *cache,
/* fatal: stop the mirror, exit non-zero */
hts_store_release_int(&opt->state.exit_xh, -1);
} else {
hts_log_print(
opt, LOG_WARNING, "cache write failed (%s: %s), entry not cached: %s%s",
what, hts_get_zerror(zErr, errbuf, sizeof(errbuf)), url_adr, url_fil);
hts_log_print(opt, LOG_WARNING,
"cache write failed (%s: %s), entry not cached: %s%s", what,
hts_get_zerror(zErr, errbuf, sizeof(errbuf)),
adr_nologin(opt, url_adr), url_fil);
}
}

Expand Down Expand Up @@ -274,7 +277,7 @@ void cache_keep_previous(httrackp *opt, cache_back *cache, const char *url_adr,
URL's file. */
if (r.statuscode > 0 && strcmp(previous_save, url_save) == 0) {
hts_log_print(opt, LOG_DEBUG, "keeping the previous cache entry for %s%s",
url_adr, url_fil);
adr_nologin(opt, url_adr), url_fil);
cache_add_ex(opt, cache, &r, url_adr, url_fil, url_save, opt->all_in_cache,
StringBuff(opt->path_html_utf8), HTS_TRUE);
}
Expand Down Expand Up @@ -336,12 +339,12 @@ static void cache_add_ex(httrackp *opt, cache_back *cache, const htsblk *r,
if (r->is_write && url_save != NULL && strnotempty(url_save)) {
hts_log_print(opt, LOG_WARNING,
"file too large for the cache, storing headers only: %s%s",
url_adr, url_fil);
adr_nologin(opt, url_adr), url_fil);
dataincache = 0;
} else {
hts_log_print(opt, LOG_WARNING,
"entry too large for the cache, not cached: %s%s", url_adr,
url_fil);
"entry too large for the cache, not cached: %s%s",
adr_nologin(opt, url_adr), url_fil);
return;
}
}
Expand Down Expand Up @@ -407,7 +410,7 @@ static void cache_add_ex(httrackp *opt, cache_back *cache, const htsblk *r,
if (headersDropped != 0) {
hts_log_print(opt, LOG_WARNING,
"cached headers too large, %d field(s) dropped: %s%s",
headersDropped, url_adr, url_fil);
headersDropped, adr_nologin(opt, url_adr), url_fil);
}

/* Filename */
Expand All @@ -421,7 +424,7 @@ static void cache_add_ex(httrackp *opt, cache_back *cache, const htsblk *r,
url_fil)) {
hts_log_print(opt, LOG_WARNING,
"URL too long to be cached, entry not cached: %s%s",
url_adr, url_fil);
adr_nologin(opt, url_adr), url_fil);
return;
}
}
Expand Down Expand Up @@ -720,7 +723,7 @@ static htsblk cache_readex_new(httrackp *opt, cache_back *cache,
if (!hts_location_is_safe(r.location)) {
hts_log_print(opt, LOG_WARNING,
"cached Location naming a post token, dropped: %s%s",
adr, fil);
adr_nologin(opt, adr), fil);
r.location[0] = '\0';
}

Expand Down Expand Up @@ -750,7 +753,7 @@ static htsblk cache_readex_new(httrackp *opt, cache_back *cache,
hts_log_print(opt, LOG_WARNING,
"cached filename leaving the mirror, "
"not using the cache entry: %s%s",
adr, fil);
adr_nologin(opt, adr), fil);
r.statuscode = STATUSCODE_INVALID;
strcpybuff(r.msg, "Cache Read Error : Bad Filename");
}
Expand All @@ -761,7 +764,7 @@ static htsblk cache_readex_new(httrackp *opt, cache_back *cache,
hts_log_print(opt, LOG_WARNING,
"cached filename too long once rebuilt under '%s', "
"not using the cache entry: %s%s",
path_html, adr, fil);
path_html, adr_nologin(opt, adr), fil);
r.statuscode = STATUSCODE_INVALID;
strcpybuff(r.msg, "Cache Read Error : Filename Too Long");
}
Expand Down
Loading
Loading