Bug 3390: Proxy auth data visible to scripts

diff --git a/src/HttpHeader.cc b/src/HttpHeader.cc
index cf398e7f23e49fbd8c06d3fadf894bc5cd9c4a3f..b0db44e252887eb28afdeb1a0b927cbf0dc77093 100644 (file)
--- a/src/HttpHeader.cc
+++ b/src/HttpHeader.cc
@@ -698,16 +698,29 @@ reset:
 
 /* packs all the entries using supplied packer */
 void
-HttpHeader::packInto(Packer * p) const
+HttpHeader::packInto(Packer * p, bool mask_sensitive_info) const
 {
     HttpHeaderPos pos = HttpHeaderInitPos;
     const HttpHeaderEntry *e;
     assert(p);
     debugs(55, 7, "packing hdr: (" << this << ")");
     /* pack all entries one by one */
-    while ((e = getEntry(&pos)))
-        e->packInto(p);
-
+    while ((e = getEntry(&pos))) {
+        if (!mask_sensitive_info) {
+            e->packInto(p);
+            continue;
+        }
+        switch (e->id) {
+        case HDR_AUTHORIZATION:
+        case HDR_PROXY_AUTHORIZATION:
+            packerAppend(p, e->name.rawBuf(), e->name.size());
+            packerAppend(p, ": ** NOT DISPLAYED **\r\n", 23);
+            break;
+        default:
+            e->packInto(p);
+            break;
+        }
+    }
     /* Pack in the "special" entries */
 
     /* Cache-Control */

diff --git a/src/HttpHeader.h b/src/HttpHeader.h
index 999e8345a20d18638da31c56ee2f5f3002042343..cf0c336a4385feaba36202b712d9f6790c50e1ce 100644 (file)
--- a/src/HttpHeader.h
+++ b/src/HttpHeader.h
@@ -234,7 +234,7 @@ public:
     void compact();
     int reset();
     int parse(const char *header_start, const char *header_end);
-    void packInto(Packer * p) const;
+    void packInto(Packer * p, bool mask_sensitive_info=false) const;
     HttpHeaderEntry *getEntry(HttpHeaderPos * pos) const;
     HttpHeaderEntry *findEntry(http_hdr_type id) const;
     int delByName(const char *name);

diff --git a/src/errorpage.cc b/src/errorpage.cc
index ef1418017da69c1fbba8af24d34408f83f408c97..a24169ece6bd7cc16340b3c5500eb225eb1fe8d7 100644 (file)
--- a/src/errorpage.cc
+++ b/src/errorpage.cc
@@ -991,7 +991,7 @@ ErrorState::Convert(char token, bool building_deny_info_url, bool allowRecursion
                       AnyP::ProtocolType_str[request->http_ver.protocol],
                       request->http_ver.major, request->http_ver.minor);
             packerToMemInit(&pck, &mb);
-            request->header.packInto(&pck);
+            request->header.packInto(&pck, true); //hide authorization data
             packerClean(&pck);
         } else if (request_hdrs) {
             p = request_hdrs;