mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(auth): bind request auth snapshots

Browse Source
This commit is contained in:
marcopan
2026-08-17 01:11:25 +02:00
parent 94c2cd3709
commit 09e546c1ef
8 changed files with 308 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/tht/internal/authconfig/password.go
+4 -3
View File
@@ -20,7 +20,7 @@ const (
argon2SaltBytes = 16
argon2KeyBytes uint32 = 32
maximumPHCBytes = 256
maximumPHCBytes = 256
)
type argon2Parameters struct {
@@ -130,8 +130,9 @@ func decodePHCBase64(value string, minimum, maximum int) ([]byte, bool) {
if value == "" || strings.ContainsRune(value, '=') || len(value) > base64.RawStdEncoding.EncodedLen(maximum) || len(value) < base64.RawStdEncoding.EncodedLen(minimum)-1 {
return nil, false
}
decoded, err := base64.RawStdEncoding.DecodeString(value)
if err != nil || len(decoded) < minimum || len(decoded) > maximum {
encoding := base64.RawStdEncoding.Strict()
decoded, err := encoding.DecodeString(value)
if err != nil || len(decoded) < minimum || len(decoded) > maximum || encoding.EncodeToString(decoded) != value {
return nil, false
}
return decoded, true
tools/tht/internal/authconfig/password_test.go
+6 -1
View File
@@ -57,14 +57,19 @@ func TestVerifyPasswordRejectsMalformedAndOversizedPHCBeforeHashing(t *testing.T
"memory too large": "$argon2id$v=19$m=262145,t=1,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4",
"passes too large": "$argon2id$v=19$m=65536,t=11,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4",
"parallelism too large": "$argon2id$v=19$m=65536,t=3,p=5$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4",
"weak bounded policy": "$argon2id$v=19$m=8,t=1,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4",
"weak bounded policy": "$argon2id$v=19$m=8,t=1,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4",
"short salt": "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0O$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4",
"long digest": "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"noncanonical salt": "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODx$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4",
"noncanonical digest": "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC5",
} {
t.Run(name, func(t *testing.T) {
if VerifyPassword(password, encoded) {
t.Fatal("VerifyPassword() accepted an invalid PHC string")
}
if err := validatePasswordHash(encoded); err == nil {
t.Fatal("validatePasswordHash() accepted an invalid PHC string")
}
})
}
}