Diff options
Diffstat (limited to 'tests/extensions/test-auth.lua')
| -rw-r--r-- | tests/extensions/test-auth.lua | 22 |
1 file changed, 22 insertions, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 5d3541c..97638bd 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -278,6 +278,28 @@ out, ret = run_action("authenticate-post", { }) h.contains("an unknown user is told nothing different", out, "Set-Cookie: cgitauth=; ") +-- crypt's work grows with the password, so one past the cap is turned down +-- before crypt sees it. +local unistd = require("posix.unistd") +local real_crypt = unistd.crypt +local crypt_calls = 0 +unistd.crypt = function(...) + crypt_calls = crypt_calls + 1 + return real_crypt(...) +end +out, ret = run_action("authenticate-post", { + method = "POST", + body = "username=Alice&password=" .. string.rep("a", 257) .. "&redirect=" .. url_encode(way_back), +}) +h.contains("an overlong password is turned down", out, "Set-Cookie: cgitauth=; ") +h.equals("without spending crypt on it", crypt_calls, 0) +out, ret = run_action("authenticate-post", { + method = "POST", + body = "username=Alice&password=" .. string.rep("a", 256) .. "&redirect=" .. url_encode(way_back), +}) +h.equals("a password at the cap is still checked", crypt_calls, 1) +unistd.crypt = real_crypt + out, ret = run_action("authenticate-post", { method = "POST", body = "username=Alice&password=" .. url_encode(password), |