What the developer wrote
Authored by takeshikurosawaa
net: cleanup SOCKS5 auth logging
Do not log SOCKS5 auth credentials.
Keep the log entry for the auth path, but omit the
username and password.
No behavior change intended.
What changed, and why it matters
This commit removes a debug log line that printed SOCKS5 proxy usernames and passwords in plain text. The change prevents sensitive credentials from being written to log files, which could otherwise expose them to anyone with access to those logs. It is a straightforward cleanup with clear security benefit, though it only affects debug-level logging.
Apply the patch. Review other logging sites for similar credential exposure, especially in debug-level proxy and network paths. Consider whether existing log files may contain exposed credentials and rotate or sanitize them if necessary.
Security signals we found
Sensitive credential logging removed
Debug log contained plaintext username and password
Information disclosure risk in log files
Evidence from the diff
In src/netbase.cpp, the Socks5() function previously logged the proxy username and password via LogDebug(BCLog::PROXY, …). The patch replaces that line with a generic message that confirms authentication is being sent without including the actual credentials. This eliminates a sensitive data exposure vector in debug logs. No protocol or functional behavior change is intended.
Changed components
src/netbase.cppSOCKS5 proxy authentication loggingInspect captured patch +1 / −1
diff --git a/src/netbase.cpp b/src/netbase.cpp
index 5ac7d22a..273b38f1 100644
--- a/src/netbase.cpp
+++ b/src/netbase.cpp
@@ -432,7 +432,7 @@ bool Socks5(const std::string& strDest, uint16_t port, const ProxyCredentials* a
vAuth.push_back(auth->password.size());
vAuth.insert(vAuth.end(), auth->password.begin(), auth->password.end());
sock.SendComplete(vAuth, g_socks5_recv_timeout, g_socks5_interrupt);
- LogDebug(BCLog::PROXY, "SOCKS5 sending proxy authentication %s:%s\n", auth->username, auth->password);
+ LogDebug(BCLog::PROXY, "SOCKS5 sending username/password authentication\n");
uint8_t pchRetA[2];
if (InterruptibleRecv(pchRetA, 2, g_socks5_recv_timeout, sock) != IntrRecvError::OK) {
LogError("Error reading proxy authentication response\n");
Why this scored 49/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.