From 3f3259b3edadd1cd23677e921efcaaff205e5b0a Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 14:59:01 -1000 Subject: Check a login when crypt cannot check the hash crypt(3) answers nil for a kind of hash the system does not check, but the stand-in never did, so a login that raised on it, or let it through, passed. --- tests/extensions/test-auth.lua | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'tests/extensions/test-auth.lua') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 295cb92..ac849c6 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -92,12 +92,18 @@ load_script() local session_name = "__Host-cgitauth" -- crypt is watched through the module the script requires, so a check can --- see whether a login spent it and on which hash. +-- see whether a login spent it and on which hash. With crypt_unchecked set +-- it answers nil, as crypt(3) does for a kind of hash the system does not +-- check. local unistd = require("posix.unistd") local real_crypt = unistd.crypt local crypt_settings = {} +local crypt_unchecked = false unistd.crypt = function(trypass, setting) crypt_settings[#crypt_settings + 1] = setting + if crypt_unchecked then + return nil + end return real_crypt(trypass, setting) end @@ -557,6 +563,11 @@ local wrong_password = out h.contains("a bad password redirects the same way", out, "Status: 302") h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n") h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ") +crypt_unchecked = true +local answered, answer = pcall(login, "Alice", password, way_back) +crypt_unchecked = false +h.check("a hash the system cannot check turns a login down without an error", answered, tostring(answer)) +h.equals("as a wrong password does", answer, wrong_password) h.contains("and is logged with the name and the page", h.error_log(), "[cgit] Failed login as Alice for /repo/\n") h.excludes("but never with the password", h.error_log(), "wrong") -- cgit 2.12.1