From 89531b39ee166849486b9e8d26d4468b19438eb7 Mon Sep 17 00:00:00 2001
From: Gwyneth Llewelyn <gwyneth.llewelyn@gwynethllewelyn.net>
Date: Sun, 10 May 2026 21:08:18 +0100
Subject: [PATCH] Potential fix for code scanning alert no. 11309: Clear-text
 logging of sensitive information

This is a quick AI-generated fix to avoid writing passwords to the logs.
There are a few packages to do just that, and I may change that in the future, but, for now, this should work fine.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 extras/goRemoteAdmin/goRemoteAdmin.go | 28 ++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/extras/goRemoteAdmin/goRemoteAdmin.go b/extras/goRemoteAdmin/goRemoteAdmin.go
index ac64a74..beb06b5 100644
--- a/extras/goRemoteAdmin/goRemoteAdmin.go
+++ b/extras/goRemoteAdmin/goRemoteAdmin.go
@@ -16,6 +16,7 @@ import (
 	"net/mail"
 	"os"
 	"reflect"
+	"strings"
 	"time"
 
 	"github.com/earthboundkid/versioninfo/v2" // mostly to get the git version of this build!
@@ -27,6 +28,31 @@ import (
 // No harm is done having just one context, which is simoly the background.
 var ctx = context.Background()
 
+func redactXMLRPCPassword(requestBody string) string {
+	const startTag = "<name>password</name>"
+	startIdx := strings.Index(requestBody, startTag)
+	if startIdx == -1 {
+		return requestBody
+	}
+
+	const openValueTag = "<value><string>"
+	const closeValueTag = "</string></value>"
+
+	valueStart := strings.Index(requestBody[startIdx:], openValueTag)
+	if valueStart == -1 {
+		return requestBody
+	}
+	valueStart += startIdx + len(openValueTag)
+
+	valueEnd := strings.Index(requestBody[valueStart:], closeValueTag)
+	if valueEnd == -1 {
+		return requestBody
+	}
+	valueEnd += valueStart
+
+	return requestBody[:valueStart] + "***REDACTED***" + requestBody[valueEnd:]
+}
+
 type XmlRpcParameter struct {
 	Parameter string `xmlrpc:"parameter"`
 	Value     string `xmlrpc:"string"`
@@ -285,7 +311,7 @@ known to OpenSimulator. You can get a copy from <https://github.com/MarcelEdward
 						// should do some sanitation here
 
 						if verboseMode {
-							fmt.Printf("Request: %v\n", xmlrpcRequest.String())
+							fmt.Printf("Request: %v\n", redactXMLRPCPassword(xmlrpcRequest.String()))
 						}
 						var client http.Client