Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-20 08:38:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Avoid use of color functions

Browse Source 
run_freak() and run_logjam() were using the color functions $magenta and $off (from set_color_functions()) in the sting $addtl_warning. This worked okay for the terminal output, but not for the HTML output or fileout().

This commit fixes run_freak() and run_logjam() by using pr_warning() for the terminal and HTML output and plaintext for fileout().

This commit also deletes the unused color functions from set_color_functions() and adds a note discouraging the use of the color functions that are still defined there.
This commit is contained in:
David Cooper
2026-09-16 08:48:38 -07:00
committed by David
parent a572046f14
commit d99132fb5c
1 changed files with 18 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testssl.sh
+18 -37
View File
@@ -773,6 +773,9 @@ pr_boldurl() { tm_bold "$1"; html_out "<a href=\"$(html_reserved "$1")\" style=\
### color switcher (see e.g. https://linuxtidbits.wordpress.com/2008/08/11/output-color-on-bash-scripts/
### https://www.tldp.org/HOWTO/Bash-Prompt-HOWTO/x405.html
### no output support for HTML!
### NOTE: These color functions (brown, yellow, off) are used in emphasize_stuff_in_headers(), but should
### generally be avoided, Functions such as pr_svrty_low() and pr_svrty_medium() should be used instead, as
### they handle both terminal and HTML output.
set_color_functions() {
local ncurses_tput=true
@@ -784,56 +787,26 @@ set_color_functions() {
fi
# Empty all vars if we have COLOR=0 equals no escape code -- these are globals:
red=""
green=""
brown=""
blue=""
magenta=""
cyan=""
grey=""
yellow=""
off=""
bold=""
underline=""
italic=""
type -p tput &>/dev/null || return 0 # Hey wait, do we actually have tput / ncurses ?
tput cols &>/dev/null || return 0 # tput under BSDs and GNUs doesn't work either (TERM undefined?)
tput sgr0 &>/dev/null || ncurses_tput=false
if [[ "$COLOR" -ge 2 ]]; then
if $ncurses_tput; then
red=$(tput setaf 1)
green=$(tput setaf 2)
brown=$(tput setaf 3)
blue=$(tput setaf 4)
magenta=$(tput setaf 5)
cyan=$(tput setaf 6)
grey=$(tput setaf 7)
yellow=$(tput setaf 3; tput bold)
else # this is a try for old BSD, see terminfo(5)
red=$(tput AF 1)
green=$(tput AF 2)
brown=$(tput AF 3)
blue=$(tput AF 4)
magenta=$(tput AF 5)
cyan=$(tput AF 6)
grey=$(tput AF 7)
yellow=$(tput AF 3; tput md)
fi
fi
if [[ "$COLOR" -ge 1 ]]; then
if $ncurses_tput; then
bold=$(tput bold)
underline=$(tput sgr 0 1 2>/dev/null)
italic=$(tput sitm) # This doesn't work on FreeBSDi (9,10) and OpenBSD ...
italic_end=$(tput ritm) # ... and this, too
off=$(tput sgr0)
else # this is a try for old BSD, see terminfo(5)
bold=$(tput md)
underline=$(tput us)
italic=$(tput ZH 2>/dev/null) # This doesn't work on FreeBSDi (9,10) and OpenBSD
italic_end=$(tput ZR 2>/dev/null) # ... probably entry missing in /etc/termcap
reverse=$(tput mr)
off=$(tput me)
fi
fi
@@ -19223,7 +19196,7 @@ run_freak() {
return 0
;;
1|2|3)
addtl_warning=" ($magenta""tested only with $nr_supported_ciphers out of 9 ciphers only!$off)" ;;
addtl_warning=" (tested only with $nr_supported_ciphers out of 9 ciphers only!)" ;;
4|5|6|7)
addtl_warning=" (tested with $nr_supported_ciphers/9 ciphers)" ;;
8|9|10|11)
@@ -19261,7 +19234,12 @@ run_freak() {
pr_svrty_critical "VULNERABLE (NOT ok)"; out ", uses EXPORT RSA ciphers"
fileout "$jsonID" "CRITICAL" "VULNERABLE, uses EXPORT RSA ciphers" "$cve" "$cwe" "$hint"
else
pr_svrty_best "not vulnerable (OK)"; out "$addtl_warning"
pr_svrty_best "not vulnerable (OK)"
if [[ -n "$addtl_warning" ]] && [[ $nr_supported_ciphers -le 3 ]]; then
out " ("; pr_warning "${addtl_warning:2:-1}"; out ")"
else
out "$addtl_warning"
fi
fileout "$jsonID" "OK" "not vulnerable $addtl_warning" "$cve" "$cwe"
fi
outln
@@ -19423,7 +19401,7 @@ run_logjam() {
out "$spaces"
openssl_no_expdhciphers=true
;;
1|2|3) addtl_warning=" ($magenta""tested w/ $nr_supported_ciphers/4 ciphers only!$off)" ;;
1|2|3) addtl_warning=" (tested w/ $nr_supported_ciphers/4 ciphers only!)" ;;
4) ;;
esac
fi
@@ -19529,16 +19507,16 @@ run_logjam() {
out_common_prime "$jsonID2" "$cve" "$cwe"
if ! "$openssl_no_expdhciphers"; then
outln ","
out "${spaces}but no DH EXPORT ciphers${addtl_warning}"
out "${spaces}but no DH EXPORT ciphers"
fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe"
fi
elif [[ $subret -eq 3 ]]; then
pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers${addtl_warning}"
pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers"
fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe"
out ", no DH key detected with <= TLS 1.2"
fileout "$jsonID2" "OK" "no DH key with <= TLS 1.2" "$cve" "$cwe"
elif [[ $subret -eq 0 ]]; then
pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers${addtl_warning}"
pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers"
fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe"
# we issue a special warning if there's no common prime but the bit length is too low
if [[ $DH_GROUP_LEN_P -le 1024 ]]; then
@@ -19554,9 +19532,12 @@ run_logjam() {
fileout "$jsonID2" "OK" "--" "$cve" "$cwe"
fi
elif [[ $ret -eq 1 ]]; then
pr_svrty_good "partly not vulnerable:"; out " no DH EXPORT ciphers${addtl_warning}"
pr_svrty_good "partly not vulnerable:"; out " no DH EXPORT ciphers"
fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe"
fi
if [[ -n "$addtl_warning" ]]; then
out " ("; pr_warning "${addtl_warning:2:-1}"; out ")"
fi
fi
[[ $DH_GROUP_LEN_P -gt 0 ]] && set_key_str_score "DHE" $DH_GROUP_LEN_P