From d99132fb5c497f36d94a7783f099579a6b49ac0f Mon Sep 17 00:00:00 2001 From: David Cooper Date: Mon, 14 Sep 2026 13:38:39 -0700 Subject: [PATCH 1/2] Avoid use of color functions run_freak() and run_logjam() were using the color functions $magenta and $off (from set_color_functions()) in the sting $addtl_warning. This worked okay for the terminal output, but not for the HTML output or fileout(). This commit fixes run_freak() and run_logjam() by using pr_warning() for the terminal and HTML output and plaintext for fileout(). This commit also deletes the unused color functions from set_color_functions() and adds a note discouraging the use of the color functions that are still defined there. --- testssl.sh | 55 ++++++++++++++++++------------------------------------ 1 file changed, 18 insertions(+), 37 deletions(-) diff --git a/testssl.sh b/testssl.sh index a4a9a6a..a967aa3 100755 --- a/testssl.sh +++ b/testssl.sh @@ -773,6 +773,9 @@ pr_boldurl() { tm_bold "$1"; html_out "/dev/null || return 0 # Hey wait, do we actually have tput / ncurses ? tput cols &>/dev/null || return 0 # tput under BSDs and GNUs doesn't work either (TERM undefined?) tput sgr0 &>/dev/null || ncurses_tput=false if [[ "$COLOR" -ge 2 ]]; then if $ncurses_tput; then - red=$(tput setaf 1) - green=$(tput setaf 2) brown=$(tput setaf 3) - blue=$(tput setaf 4) - magenta=$(tput setaf 5) - cyan=$(tput setaf 6) - grey=$(tput setaf 7) yellow=$(tput setaf 3; tput bold) else # this is a try for old BSD, see terminfo(5) - red=$(tput AF 1) - green=$(tput AF 2) brown=$(tput AF 3) - blue=$(tput AF 4) - magenta=$(tput AF 5) - cyan=$(tput AF 6) - grey=$(tput AF 7) yellow=$(tput AF 3; tput md) fi fi if [[ "$COLOR" -ge 1 ]]; then if $ncurses_tput; then - bold=$(tput bold) - underline=$(tput sgr 0 1 2>/dev/null) - italic=$(tput sitm) # This doesn't work on FreeBSDi (9,10) and OpenBSD ... - italic_end=$(tput ritm) # ... and this, too off=$(tput sgr0) else # this is a try for old BSD, see terminfo(5) - bold=$(tput md) - underline=$(tput us) - italic=$(tput ZH 2>/dev/null) # This doesn't work on FreeBSDi (9,10) and OpenBSD - italic_end=$(tput ZR 2>/dev/null) # ... probably entry missing in /etc/termcap - reverse=$(tput mr) off=$(tput me) fi fi @@ -19223,7 +19196,7 @@ run_freak() { return 0 ;; 1|2|3) - addtl_warning=" ($magenta""tested only with $nr_supported_ciphers out of 9 ciphers only!$off)" ;; + addtl_warning=" (tested only with $nr_supported_ciphers out of 9 ciphers only!)" ;; 4|5|6|7) addtl_warning=" (tested with $nr_supported_ciphers/9 ciphers)" ;; 8|9|10|11) @@ -19261,7 +19234,12 @@ run_freak() { pr_svrty_critical "VULNERABLE (NOT ok)"; out ", uses EXPORT RSA ciphers" fileout "$jsonID" "CRITICAL" "VULNERABLE, uses EXPORT RSA ciphers" "$cve" "$cwe" "$hint" else - pr_svrty_best "not vulnerable (OK)"; out "$addtl_warning" + pr_svrty_best "not vulnerable (OK)" + if [[ -n "$addtl_warning" ]] && [[ $nr_supported_ciphers -le 3 ]]; then + out " ("; pr_warning "${addtl_warning:2:-1}"; out ")" + else + out "$addtl_warning" + fi fileout "$jsonID" "OK" "not vulnerable $addtl_warning" "$cve" "$cwe" fi outln @@ -19423,7 +19401,7 @@ run_logjam() { out "$spaces" openssl_no_expdhciphers=true ;; - 1|2|3) addtl_warning=" ($magenta""tested w/ $nr_supported_ciphers/4 ciphers only!$off)" ;; + 1|2|3) addtl_warning=" (tested w/ $nr_supported_ciphers/4 ciphers only!)" ;; 4) ;; esac fi @@ -19529,16 +19507,16 @@ run_logjam() { out_common_prime "$jsonID2" "$cve" "$cwe" if ! "$openssl_no_expdhciphers"; then outln "," - out "${spaces}but no DH EXPORT ciphers${addtl_warning}" + out "${spaces}but no DH EXPORT ciphers" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" fi elif [[ $subret -eq 3 ]]; then - pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers${addtl_warning}" + pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" out ", no DH key detected with <= TLS 1.2" fileout "$jsonID2" "OK" "no DH key with <= TLS 1.2" "$cve" "$cwe" elif [[ $subret -eq 0 ]]; then - pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers${addtl_warning}" + pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" # we issue a special warning if there's no common prime but the bit length is too low if [[ $DH_GROUP_LEN_P -le 1024 ]]; then @@ -19554,9 +19532,12 @@ run_logjam() { fileout "$jsonID2" "OK" "--" "$cve" "$cwe" fi elif [[ $ret -eq 1 ]]; then - pr_svrty_good "partly not vulnerable:"; out " no DH EXPORT ciphers${addtl_warning}" + pr_svrty_good "partly not vulnerable:"; out " no DH EXPORT ciphers" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" fi + if [[ -n "$addtl_warning" ]]; then + out " ("; pr_warning "${addtl_warning:2:-1}"; out ")" + fi fi [[ $DH_GROUP_LEN_P -gt 0 ]] && set_key_str_score "DHE" $DH_GROUP_LEN_P From f7cc8108d0c063e73ed9e9812008c68fa35a7545 Mon Sep 17 00:00:00 2001 From: David Date: Wed, 16 Sep 2026 09:02:59 -0700 Subject: [PATCH 2/2] Remove remaining color functions This commit removes definitions for "yellow," "brown," and "off," which are no longer used now that emphasize_stuff_in_headers() has been rewritten. --- testssl.sh | 34 ---------------------------------- 1 file changed, 34 deletions(-) diff --git a/testssl.sh b/testssl.sh index a967aa3..dbfecad 100755 --- a/testssl.sh +++ b/testssl.sh @@ -770,47 +770,13 @@ prln_fixme() { prln_warning "Fixme: $1"; } pr_url() { tm_out "$1"; html_out "$(html_reserved "$1")"; } pr_boldurl() { tm_bold "$1"; html_out "$(html_reserved "$1")"; } -### color switcher (see e.g. https://linuxtidbits.wordpress.com/2008/08/11/output-color-on-bash-scripts/ -### https://www.tldp.org/HOWTO/Bash-Prompt-HOWTO/x405.html -### no output support for HTML! -### NOTE: These color functions (brown, yellow, off) are used in emphasize_stuff_in_headers(), but should -### generally be avoided, Functions such as pr_svrty_low() and pr_svrty_medium() should be used instead, as -### they handle both terminal and HTML output. set_color_functions() { - local ncurses_tput=true - if [[ $SYSTEM == OpenBSD ]] && [[ "$TERM" =~ xterm-256 ]]; then export TERM=xterm # OpenBSD can't handle 256 colors (yet) in xterm which might lead to ugly errors # like "tput: not enough arguments (3) for capability `AF'". Not our fault but # before we get blamed we fix it here. fi - - # Empty all vars if we have COLOR=0 equals no escape code -- these are globals: - brown="" - yellow="" - off="" - - type -p tput &>/dev/null || return 0 # Hey wait, do we actually have tput / ncurses ? - tput cols &>/dev/null || return 0 # tput under BSDs and GNUs doesn't work either (TERM undefined?) - tput sgr0 &>/dev/null || ncurses_tput=false - if [[ "$COLOR" -ge 2 ]]; then - if $ncurses_tput; then - brown=$(tput setaf 3) - yellow=$(tput setaf 3; tput bold) - else # this is a try for old BSD, see terminfo(5) - brown=$(tput AF 3) - yellow=$(tput AF 3; tput md) - fi - fi - if [[ "$COLOR" -ge 1 ]]; then - if $ncurses_tput; then - off=$(tput sgr0) - else # this is a try for old BSD, see terminfo(5) - off=$(tput me) - fi - fi - # FreeBSD 10 understands ESC codes like 'echo -e "\e[3mfoobar\e[23m"', but also no tput for italics } ###### START universal helper function definitions ######