From d99132fb5c497f36d94a7783f099579a6b49ac0f Mon Sep 17 00:00:00 2001 From: David Cooper Date: Mon, 14 Sep 2026 13:38:39 -0700 Subject: [PATCH] Avoid use of color functions run_freak() and run_logjam() were using the color functions $magenta and $off (from set_color_functions()) in the sting $addtl_warning. This worked okay for the terminal output, but not for the HTML output or fileout(). This commit fixes run_freak() and run_logjam() by using pr_warning() for the terminal and HTML output and plaintext for fileout(). This commit also deletes the unused color functions from set_color_functions() and adds a note discouraging the use of the color functions that are still defined there. --- testssl.sh | 55 ++++++++++++++++++------------------------------------ 1 file changed, 18 insertions(+), 37 deletions(-) diff --git a/testssl.sh b/testssl.sh index a4a9a6a..a967aa3 100755 --- a/testssl.sh +++ b/testssl.sh @@ -773,6 +773,9 @@ pr_boldurl() { tm_bold "$1"; html_out "/dev/null || return 0 # Hey wait, do we actually have tput / ncurses ? tput cols &>/dev/null || return 0 # tput under BSDs and GNUs doesn't work either (TERM undefined?) tput sgr0 &>/dev/null || ncurses_tput=false if [[ "$COLOR" -ge 2 ]]; then if $ncurses_tput; then - red=$(tput setaf 1) - green=$(tput setaf 2) brown=$(tput setaf 3) - blue=$(tput setaf 4) - magenta=$(tput setaf 5) - cyan=$(tput setaf 6) - grey=$(tput setaf 7) yellow=$(tput setaf 3; tput bold) else # this is a try for old BSD, see terminfo(5) - red=$(tput AF 1) - green=$(tput AF 2) brown=$(tput AF 3) - blue=$(tput AF 4) - magenta=$(tput AF 5) - cyan=$(tput AF 6) - grey=$(tput AF 7) yellow=$(tput AF 3; tput md) fi fi if [[ "$COLOR" -ge 1 ]]; then if $ncurses_tput; then - bold=$(tput bold) - underline=$(tput sgr 0 1 2>/dev/null) - italic=$(tput sitm) # This doesn't work on FreeBSDi (9,10) and OpenBSD ... - italic_end=$(tput ritm) # ... and this, too off=$(tput sgr0) else # this is a try for old BSD, see terminfo(5) - bold=$(tput md) - underline=$(tput us) - italic=$(tput ZH 2>/dev/null) # This doesn't work on FreeBSDi (9,10) and OpenBSD - italic_end=$(tput ZR 2>/dev/null) # ... probably entry missing in /etc/termcap - reverse=$(tput mr) off=$(tput me) fi fi @@ -19223,7 +19196,7 @@ run_freak() { return 0 ;; 1|2|3) - addtl_warning=" ($magenta""tested only with $nr_supported_ciphers out of 9 ciphers only!$off)" ;; + addtl_warning=" (tested only with $nr_supported_ciphers out of 9 ciphers only!)" ;; 4|5|6|7) addtl_warning=" (tested with $nr_supported_ciphers/9 ciphers)" ;; 8|9|10|11) @@ -19261,7 +19234,12 @@ run_freak() { pr_svrty_critical "VULNERABLE (NOT ok)"; out ", uses EXPORT RSA ciphers" fileout "$jsonID" "CRITICAL" "VULNERABLE, uses EXPORT RSA ciphers" "$cve" "$cwe" "$hint" else - pr_svrty_best "not vulnerable (OK)"; out "$addtl_warning" + pr_svrty_best "not vulnerable (OK)" + if [[ -n "$addtl_warning" ]] && [[ $nr_supported_ciphers -le 3 ]]; then + out " ("; pr_warning "${addtl_warning:2:-1}"; out ")" + else + out "$addtl_warning" + fi fileout "$jsonID" "OK" "not vulnerable $addtl_warning" "$cve" "$cwe" fi outln @@ -19423,7 +19401,7 @@ run_logjam() { out "$spaces" openssl_no_expdhciphers=true ;; - 1|2|3) addtl_warning=" ($magenta""tested w/ $nr_supported_ciphers/4 ciphers only!$off)" ;; + 1|2|3) addtl_warning=" (tested w/ $nr_supported_ciphers/4 ciphers only!)" ;; 4) ;; esac fi @@ -19529,16 +19507,16 @@ run_logjam() { out_common_prime "$jsonID2" "$cve" "$cwe" if ! "$openssl_no_expdhciphers"; then outln "," - out "${spaces}but no DH EXPORT ciphers${addtl_warning}" + out "${spaces}but no DH EXPORT ciphers" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" fi elif [[ $subret -eq 3 ]]; then - pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers${addtl_warning}" + pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" out ", no DH key detected with <= TLS 1.2" fileout "$jsonID2" "OK" "no DH key with <= TLS 1.2" "$cve" "$cwe" elif [[ $subret -eq 0 ]]; then - pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers${addtl_warning}" + pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" # we issue a special warning if there's no common prime but the bit length is too low if [[ $DH_GROUP_LEN_P -le 1024 ]]; then @@ -19554,9 +19532,12 @@ run_logjam() { fileout "$jsonID2" "OK" "--" "$cve" "$cwe" fi elif [[ $ret -eq 1 ]]; then - pr_svrty_good "partly not vulnerable:"; out " no DH EXPORT ciphers${addtl_warning}" + pr_svrty_good "partly not vulnerable:"; out " no DH EXPORT ciphers" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" fi + if [[ -n "$addtl_warning" ]]; then + out " ("; pr_warning "${addtl_warning:2:-1}"; out ")" + fi fi [[ $DH_GROUP_LEN_P -gt 0 ]] && set_key_str_score "DHE" $DH_GROUP_LEN_P