From 11999f1679968c376f5a570d0f671375648b6bc1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 29 Jun 2026 16:33:16 +0200 Subject: [PATCH] mysql: Be more explicit when parsing database URI but don't log password This avoids logging the password that's potentially contained in the URI and also gives clearer instructions about what's missing. Also clears the memory that stores the URI/password. --- .../plugins/mysql/mysql_database.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/libstrongswan/plugins/mysql/mysql_database.c b/src/libstrongswan/plugins/mysql/mysql_database.c index 49a77f2e2..1b0b0be7b 100644 --- a/src/libstrongswan/plugins/mysql/mysql_database.c +++ b/src/libstrongswan/plugins/mysql/mysql_database.c @@ -754,6 +754,7 @@ METHOD(database_t, destroy, void, this->mutex->destroy(this->mutex); free(this->host); free(this->username); + memwipe(this->password, this->password ? strlen(this->password) : 0); free(this->password); free(this->database); free(this); @@ -761,12 +762,13 @@ METHOD(database_t, destroy, void, static bool parse_uri(private_mysql_database_t *this, char *uri) { + const int scheme_len = strlen("mysql://"); char *username, *password, *host, *port = "0", *database, *pos; /** * parse mysql://username:pass@host:port/database uri */ - username = strdup(uri + 8); + username = strdup(uri + scheme_len); pos = strchr(username, ':'); if (pos) { @@ -798,13 +800,26 @@ static bool parse_uri(private_mysql_database_t *this, char *uri) this->password = strdup(password); this->database = strdup(database); this->port = atoi(port); + memwipe(username, strlen(uri) - scheme_len); free(username); return TRUE; } + DBG1(DBG_LIB, "parsing MySQL database uri 'mysql://%s:***@%s' " + "failed: missing '/database' part", username, host); + } + else + { + DBG1(DBG_LIB, "parsing MySQL database uri 'mysql://%s:***' " + "failed: missing '@host[:port]/database' part", username); } } + else + { + DBG1(DBG_LIB, "parsing MySQL database uri of the form " + "'mysql://username:[password]@host[:port]/database' failed"); + } + memwipe(username, strlen(uri) - scheme_len); free(username); - DBG1(DBG_LIB, "parsing MySQL database uri '%s' failed", uri); return FALSE; }