Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Turn down passwords past 256 bytes unchecked
SHA-crypt hashes the password in most of its rounds, so the 4 KB that
cgit's POST limit lets through cost about fifteen ordinary logins per
anonymous attempt.
Diffstat (limited to 'custom')
| -rw-r--r-- | custom/extensions/auth-file.lua | 6 | |
| -rw-r--r-- | custom/extensions/auth-inline.lua | 6 |
2 files changed, 10 insertions, 2 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 90f597b..f43eb82 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -86,6 +86,10 @@ local cookie_path = "/" -- Set this true only if cgit is served over plain HTTP with no TLS anywhere. local cookie_insecure = false +-- crypt feeds the password into most of its rounds, so its work grows with +-- the password's length, and one longer than this is turned down unchecked. +local max_password_bytes = 256 + -- A throwaway hash of the documented shape, used only to spend the same work -- on a missing account as on a present one, so a failed login does not reveal -- by timing whether the user name exists. @@ -449,7 +453,7 @@ function authenticate_post() local username = post["username"] local password = post["password"] local ok = false - if username ~= nil and password ~= nil then + if username ~= nil and password ~= nil and #password <= max_password_bytes then local hash = account_hash(username) if hash == nil then -- Spend the work anyway, see dummy_hash. diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index de91f88..53b1efc 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -86,6 +86,10 @@ local cookie_path = "/" -- Set this true only if cgit is served over plain HTTP with no TLS anywhere. local cookie_insecure = false +-- crypt feeds the password into most of its rounds, so its work grows with +-- the password's length, and one longer than this is turned down unchecked. +local max_password_bytes = 256 + -- A throwaway hash of the documented shape, used only to spend the same work -- on a missing account as on a present one, so a failed login does not reveal -- by timing whether the user name exists. @@ -411,7 +415,7 @@ function authenticate_post() local username = post["username"] local password = post["password"] local ok = false - if username ~= nil and password ~= nil then + if username ~= nil and password ~= nil and #password <= max_password_bytes then local hash = account_hash(username) if hash == nil then -- Spend the work anyway, see dummy_hash. |