https://blog.qife122.com/tags/%E8%BF%9B%E7%A8%8B%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2/ Recent content in 进程信息泄露 on 办公AI智能小助手 Hugo zh-cn qife Fri, 05 Sep 2025 04:25:57 +0800 https://blog.qife122.com/p/curl%E5%91%BD%E4%BB%A4%E8%A1%8C%E5%8F%82%E6%95%B0%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/ Fri, 05 Sep 2025 04:25:57 +0800 https://blog.qife122.com/p/curl%E5%91%BD%E4%BB%A4%E8%A1%8C%E5%8F%82%E6%95%B0%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/ <h1 id="curl-不隐藏通过-cli-参数提供的-procxxxcmdline-中的凭据--报告-3000639">curl 不隐藏通过 CLI 参数提供的 /proc/XXX/cmdline 中的凭据 | 报告 #3000639</h1> <h2 id="摘要">摘要</h2> <p><code>cleanarg</code> 辅助函数在凭据没有空格提供给短选项标志时不起作用，例如 <code>-uUSER:PASS</code> 对比 <code>-u USER:PASS</code> 或 <code>-UUSER:PASS</code> 对比 <code>-U UUSER:PASS</code>。</p> <h2 id="受影响版本">受影响版本</h2> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">curl -V </span></span><span class="line"><span class="cl">curl 8.12.1 <span class="o">(</span>x86_64-pc-linux-musl<span class="o">)</span> libcurl/8.12.1 OpenSSL/3.3.3 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.64.0 </span></span><span class="line"><span class="cl">Release-Date: 2025-02-13 </span></span><span class="line"><span class="cl">Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss </span></span><span class="line"><span class="cl">Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd </span></span></code></pre></td></tr></table> </div> </div><h2 id="复现步骤">复现步骤</h2> <p>在 Linux 环境（在 zsh、bash、posix sh 中测试）运行以下命令：</p> https://blog.qife122.com/p/curl%E5%91%BD%E4%BB%A4%E8%A1%8C%E5%8F%82%E6%95%B0%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E5%9C%A8/proc%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F%E4%B8%AD%E6%9A%B4%E9%9C%B2/ Thu, 04 Sep 2025 13:57:09 +0800 https://blog.qife122.com/p/curl%E5%91%BD%E4%BB%A4%E8%A1%8C%E5%8F%82%E6%95%B0%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E5%9C%A8/proc%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F%E4%B8%AD%E6%9A%B4%E9%9C%B2/ <h1 id="curl-不隐藏通过-cli-参数提供的-procxxxcmdline-中的凭据">curl 不隐藏通过 CLI 参数提供的 /proc/XXX/cmdline 中的凭据</h1> <h2 id="摘要">摘要</h2> <p>cleanarg 辅助函数在凭据通过短选项标志无空格提供时不起作用，例如 <code>-uUSER:PASS</code> 对比 <code>-u USER:PASS</code> 或 <code>-UUSER:PASS</code> 对比 <code>-U UUSER:PASS</code>。</p> <h2 id="受影响版本">受影响版本</h2> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">curl -V </span></span><span class="line"><span class="cl">curl 8.12.1 <span class="o">(</span>x86_64-pc-linux-musl<span class="o">)</span> libcurl/8.12.1 OpenSSL/3.3.3 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.64.0 </span></span><span class="line"><span class="cl">Release-Date: 2025-02-13 </span></span><span class="line"><span class="cl">Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss </span></span><span class="line"><span class="cl">Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd </span></span></code></pre></td></tr></table> </div> </div><h2 id="重现步骤">重现步骤</h2> <p>在 Linux 环境（在 zsh、bash、posix sh 中测试）中运行这些命令：</p>