luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs/SECURITY-PROCESS.md: "Visible command line arguments"

Browse Source
This commit is contained in:
Daniel Stenberg 2022-05-03 13:37:04 +02:00
parent 0d015fb3f6
commit 45c578f662
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
docs/SECURITY-PROCESS.md
View File

@ -197,3 +197,18 @@ considered security vulnerabilities. The WHATWG URL Specification and RFC
interoperable](https://github.com/bagder/docs/blob/master/URL-interop.md).
Obvious parser bugs can still be vulnerabilities of course.
## Visible command line arguments
The curl command blanks the contents of a number of command line arguments to
prevent them from appearing in process listings. It does not blank all
arguments even if some of them that are not blanked might contain sensitive
data. We consider this functionality a best-effort and omissions are not
security vulnerabilities.
- not all systems allow the arguments to be blanked in the first place
- since curl blanks the argument itself they will be readable for a short
moment in time no matter what
- virtually every argument can contain sensitive data, depending on use
- blanking all arguments would make it impractical for users to differentiate
curl command lines in process listings