{"action":"created","issue":{"url":"https://api.github.com/repos/Ericsson/exchangecalendar/issues/317","labels_url":"https://api.github.com/repos/Ericsson/exchangecalendar/issues/317/labels{/name}","comments_url":"https://api.github.com/repos/Ericsson/exchangecalendar/issues/317/comments","events_url":"https://api.github.com/repos/Ericsson/exchangecalendar/issues/317/events","html_url":"https://github.com/Ericsson/exchangecalendar/issues/317","id":102791216,"number":317,"title":"Password logged to Error Console","user":{"login":"logological","id":831326,"avatar_url":"https://avatars.githubusercontent.com/u/831326?v=3","gravatar_id":"","url":"https://api.github.com/users/logological","html_url":"https://github.com/logological","followers_url":"https://api.github.com/users/logological/followers","following_url":"https://api.github.com/users/logological/following{/other_user}","gists_url":"https://api.github.com/users/logological/gists{/gist_id}","starred_url":"https://api.github.com/users/logological/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/logological/subscriptions","organizations_url":"https://api.github.com/users/logological/orgs","repos_url":"https://api.github.com/users/logological/repos","events_url":"https://api.github.com/users/logological/events{/privacy}","received_events_url":"https://api.github.com/users/logological/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Ericsson/exchangecalendar/labels/bug","name":"bug","color":"ff214f"},{"url":"https://api.github.com/repos/Ericsson/exchangecalendar/labels/invalid","name":"invalid","color":"e6e6e6"},{"url":"https://api.github.com/repos/Ericsson/exchangecalendar/labels/need%20info","name":"need info","color":"fef280"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-08-24T13:17:32Z","updated_at":"2015-12-04T11:35:45Z","closed_at":"2015-09-15T09:04:10Z","body":"When connecting to an Exchange server that uses SHA-1 certificates, the following log messages are visible in Thunderbird's error console:\r\n\r\n> This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.\r\nhttps://USERNAME:PASSWORD@example.com/EWS/Exchange.asmx\r\n\r\nThe problem is that \"USERNAME\" and \"PASSWORD\" are my real username and password, as entered in exchangecalendar's configuration dialogs.  The password should never be displayed in plaintext anywhere in the user interface, as this makes a shoulder-surfing attack trivial.\r\n\r\nThis is probably at least partially a security issue in Thunderbird itself (see [Bug 1197791](https://bugzilla.mozilla.org/show_bug.cgi?id=1197791)).  However, the root of the problem may be that the exchangecalendar add-on is manually constructing an HTTPS URL which contains a password in the authority component, and then passing it to Lightning or Thunderbird.  This is a known security risk and deprecated by [RFC 3986](https://tools.ietf.org/html/rfc3986).  If exchangecalendar is the originator of this URL, then it should use a more secure method of passing the user's credentials to Lightning/Thunderbird."},"comment":{"url":"https://api.github.com/repos/Ericsson/exchangecalendar/issues/comments/161945944","html_url":"https://github.com/Ericsson/exchangecalendar/issues/317#issuecomment-161945944","issue_url":"https://api.github.com/repos/Ericsson/exchangecalendar/issues/317","id":161945944,"user":{"login":"etanol","id":85804,"avatar_url":"https://avatars.githubusercontent.com/u/85804?v=3","gravatar_id":"","url":"https://api.github.com/users/etanol","html_url":"https://github.com/etanol","followers_url":"https://api.github.com/users/etanol/followers","following_url":"https://api.github.com/users/etanol/following{/other_user}","gists_url":"https://api.github.com/users/etanol/gists{/gist_id}","starred_url":"https://api.github.com/users/etanol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/etanol/subscriptions","organizations_url":"https://api.github.com/users/etanol/orgs","repos_url":"https://api.github.com/users/etanol/repos","events_url":"https://api.github.com/users/etanol/events{/privacy}","received_events_url":"https://api.github.com/users/etanol/received_events","type":"User","site_admin":false},"created_at":"2015-12-04T11:35:45Z","updated_at":"2015-12-04T11:35:45Z","body":"For the record, [this is the official fix](http://hg.mozilla.org/mozilla-central/rev/c5d35e376551) pending to propagate to the release channels.  The Bugzilla report seems to be protected, though."}}