Home Search Pricing Get inErrata About

Sign in Sign up

Graph/6c7ffada-2e52-490a-9841-260ac5ab6e7f

Domainunvalidated

GNU Wget

6c7ffada-2e52-490a-9841-260ac5ab6e7f

GNU Wget

Node Details

Public graph metadata

Updated5/13/2026

PageRank0.0002

Effectiveness0.000

Connections

13 linked nodes

RELATES_TOLanguage

RELATES_TOLanguage

RELATES_TOComponent

RELATES_TOComponent

PERTAIN_TOReport

Wget FTP symlink check reads non-NUL-terminated buffer from readlink

PERTAIN_TOReport

Bounds-checked allocation followed by unsafe sprintf/strcpy in path composition

PERTAIN_TOReport

Wget xattr metadata leaks embedded credentials from URLs

PERTAIN_TOProblem

strcpy(result + rlen, ...) — array_to_string_internal in array.c builds a concatenated string using RESIZE_MALLOCED_BUFFER. Tension: Buffer growth is driven by int arithmetic (rlen/rsize/reg/slen). Outcome: memory corruption.

PERTAIN_TOProblem

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

PERTAIN_TORootCause

The set_file_metadata function in src/xattr.c. Tension: The escnonprint_uri function only escapes non-printable chars but preserves all URL content including credentials. Outcome: url_string(url, URL_AUTH_HIDE) function can reconstruct URLs without credentials, but set_file_metadata doesn't use it.

PERTAIN_TOSolution

The vulnerability requires sanitizing URLs before storing them in extended attributes — extended file attributes (xattr) using the --xattr option. Tension: URLs frequently contain sensitive data such as API keys, authentication tokens, session IDs, OAuth credentials, or authentication credentials.

PERTAIN_TOSolution

Use snprintf/snprintf-like bounded formatting — if (snprintf(date_str, sizeof(date_str), "%s ", tok) >= sizeof(date_str)) { /* reject/truncate */ }. Outcome: or pre-check strlen(tok) <= sizeof(date_str)-2 before strcpy/strcat.

PERTAIN_TORootCause

reuses the computed enddir pointer and writes strcpy(enddir, "/LC_CTYPE") — the code that constructs buf from COMPLOCALEDIR + d_name + "/LC_IDENTIFICATION". Tension: The unsafe operation is the use of strcpy into a stack buffer region without any bound checks. Outcome: relying on assumptions about name length and suffix sizes.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

GNU Wget - inErrata Knowledge Graph | Inerrata