Avoid exposing passwords in log, on failing ldap lookup expansion. Bug 165

[exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index 922519eb9bf9d78857bc3098d7a78f3fc83103b3..f783682b4af0b1b0dacf3dc72ffd0603f4dca402 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -5409,7 +5409,7 @@ while (*s != 0)
           if (*s++ != '}')
            {
            expand_string_message = string_sprintf(
-             US"missing '}' closing arg %d of extract", i+1);
+             "missing '}' closing arg %d of extract", i+1);
            goto EXPAND_FAILED_CURLY;
            }
 
@@ -5455,7 +5455,7 @@ while (*s != 0)
         else
          {
          expand_string_message = string_sprintf(
-           US"missing '{' for arg %d of extract", i+1);
+           "missing '{' for arg %d of extract", i+1);
          goto EXPAND_FAILED_CURLY;
          }
         }
@@ -5512,7 +5512,7 @@ while (*s != 0)
         if (*s != '{')                                 /*}*/
          {
          expand_string_message = string_sprintf(
-           US"missing '{' for arg %d of listextract", i+1);
+           "missing '{' for arg %d of listextract", i+1);
          goto EXPAND_FAILED_CURLY;
          }
 
@@ -5521,7 +5521,7 @@ while (*s != 0)
        if (*s++ != '}')
          {
          expand_string_message = string_sprintf(
-           US"missing '}' closing arg %d of listextract", i+1);
+           "missing '}' closing arg %d of listextract", i+1);
          goto EXPAND_FAILED_CURLY;
          }
 
@@ -7631,6 +7631,29 @@ return OK;
 
 
 
+/* Avoid potentially exposing a password in a string about to be logged */
+
+uschar *
+expand_hide_passwords(uschar * s)
+{
+return (  (  Ustrstr(s, "failed to expand") != NULL
+         || Ustrstr(s, "expansion of ")    != NULL
+         ) 
+       && (  Ustrstr(s, "mysql")   != NULL
+         || Ustrstr(s, "pgsql")   != NULL
+         || Ustrstr(s, "redis")   != NULL
+         || Ustrstr(s, "sqlite")  != NULL
+         || Ustrstr(s, "ldap:")   != NULL
+         || Ustrstr(s, "ldaps:")  != NULL
+         || Ustrstr(s, "ldapi:")  != NULL
+         || Ustrstr(s, "ldapdn:") != NULL
+         || Ustrstr(s, "ldapm:")  != NULL
+       )  ) 
+  ? US"Temporary internal error" : s;
+}
+
+
+
 
 /*************************************************
 **************************************************