FPP crash reports contain cleartext OS and UI passwords

[nkaminski]

Hello FPP dev team,

While looking through the contents of a recently generated FPP crash report, I've noticed in FPP 6.2 that crash reports which include either settings only or settings and configuration contain the plaintext UI and OS passwords in the payload that is uploaded over the Internet.

Furthermore, I have a hard time rationalizing any material benefit from having the actual passwords present in the crash report when analyzing bugs.

Therefore, would it be possible to redact passwords in the uploaded settings/configuration (and/or @dkulp would you be open to a PR which implements this functionality)?

[dkulp]

A PR would be fine. Just keep in mind that what generating a crash report, the state of the memory is kind of unknown as we don't know what caused the crash. Thus, using a bunch of libraries/methods/etc... that do complex things may not be doable without causing further crashes.

[nkaminski]

I was thinking of refactoring the zip file creation process which is currently implemented as a set of system() calls into a shell script that is invoked via one system() call which filters out credentials using grep -v and then generates the zip as before.

Therefore, the maximal amount of recording and reporting is done out of process.

[dkulp]

That would be perfect.

[darylc]

@nkaminski Just wanted to check in and see if you were still thinking about contributing a fix for this one?

[nkaminski]

Yes, I do intend to contribute a fix within another week or so. Still finishing up getting my show taken down and put away and therefore haven't turned much attention to this.

…

On Sun, Jan 29, 2023, 5:59 PM darylc ***@***.***> wrote: @nkaminski <https://github.com/nkaminski> Just wanted to check in and see if you were still thinking about contributing a fix for this one? — Reply to this email directly, view it on GitHub <#1425 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAS6LYPVNVQP72POPWIQTQDWU374XANCNFSM6AAAAAASP7FH5E> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[darylc]

@nkaminski If you were still thinking of doing this just a heads up that FPP 7.0 release is coming up in the next weeks.

[darylc]

@computergeek1507 Do you think you'll get this done for FPP 8 or shall we move it to FPP 9 and beyond?

[computergeek1507]

Please push it out