Bug 3390: Proxy auth data visible to scripts

diff --git a/src/HttpHeader.cc b/src/HttpHeader.cc
index 90480976bd1d9320d2879b2eeb8e979957101013..89af6c390b7920c6a000c2e0952ddbe89ee3cb67 100644 (file)
--- a/src/HttpHeader.cc
+++ b/src/HttpHeader.cc
@@ -663,16 +663,29 @@ reset:
 
 /* packs all the entries using supplied packer */
 void
-HttpHeader::packInto(Packer * p) const
+HttpHeader::packInto(Packer * p, bool mask_sensitive_info) const
 {
     HttpHeaderPos pos = HttpHeaderInitPos;
     const HttpHeaderEntry *e;
     assert(p);
     debugs(55, 7, "packing hdr: (" << this << ")");
     /* pack all entries one by one */
-    while ((e = getEntry(&pos)))
-        e->packInto(p);
-
+    while ((e = getEntry(&pos))) {
+        if (!mask_sensitive_info) {
+            e->packInto(p);
+            continue;
+        }
+        switch (e->id) {
+        case HDR_AUTHORIZATION:
+        case HDR_PROXY_AUTHORIZATION:
+            packerAppend(p, e->name.rawBuf(), e->name.size());
+            packerAppend(p, ": ** NOT DISPLAYED **\r\n", 23);
+            break;
+        default:
+            e->packInto(p);
+            break;
+        }
+    }
     /* Pack in the "special" entries */
 
     /* Cache-Control */

diff --git a/src/HttpHeader.h b/src/HttpHeader.h
index c734bb1628e1c8f03f741b1ad84d334fd88fc816..aa5db817c03445fe1f3db754e999bd1eb28869b7 100644 (file)
--- a/src/HttpHeader.h
+++ b/src/HttpHeader.h
@@ -215,7 +215,7 @@ public:
     void compact();
     int reset();
     int parse(const char *header_start, const char *header_end);
-    void packInto(Packer * p) const;
+    void packInto(Packer * p, bool mask_sensitive_info=false) const;
     HttpHeaderEntry *getEntry(HttpHeaderPos * pos) const;
     HttpHeaderEntry *findEntry(http_hdr_type id) const;
     int delByName(const char *name);

diff --git a/src/errorpage.cc b/src/errorpage.cc
index ddc0772263803c214bb5a3eab664c193a01efec5..f82ede6e7a299f4eda5e34473b2661e81bda48d6 100644 (file)
--- a/src/errorpage.cc
+++ b/src/errorpage.cc
@@ -777,7 +777,7 @@ ErrorState::Convert(char token, bool allowRecursion)
                       SQUIDSTRINGPRINT(urlpath_or_slash),
                       request->http_ver.major, request->http_ver.minor);
             packerToMemInit(&pck, &mb);
-            request->header.packInto(&pck);
+            request->header.packInto(&pck, true); //hide authorization data
             packerClean(&pck);
         } else if (request_hdrs) {
             p = request_hdrs;