From a14640228314f7716115e5a43ca564057bc10d6b Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Fri, 16 Oct 2026 22:10:27 -1000
Subject: Turn down passwords past 256 bytes unchecked

SHA-crypt hashes the password in most of its rounds, so the 4 KB that
cgit's POST limit lets through cost about fifteen ordinary logins per
anonymous attempt.
---
 tests/extensions/test-auth.lua | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

(limited to 'tests')

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 5d3541c..97638bd 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -278,6 +278,28 @@ out, ret = run_action("authenticate-post", {
 })
 h.contains("an unknown user is told nothing different", out, "Set-Cookie: cgitauth=; ")
 
+-- crypt's work grows with the password, so one past the cap is turned down
+-- before crypt sees it.
+local unistd = require("posix.unistd")
+local real_crypt = unistd.crypt
+local crypt_calls = 0
+unistd.crypt = function(...)
+	crypt_calls = crypt_calls + 1
+	return real_crypt(...)
+end
+out, ret = run_action("authenticate-post", {
+	method = "POST",
+	body = "username=Alice&password=" .. string.rep("a", 257) .. "&redirect=" .. url_encode(way_back),
+})
+h.contains("an overlong password is turned down", out, "Set-Cookie: cgitauth=; ")
+h.equals("without spending crypt on it", crypt_calls, 0)
+out, ret = run_action("authenticate-post", {
+	method = "POST",
+	body = "username=Alice&password=" .. string.rep("a", 256) .. "&redirect=" .. url_encode(way_back),
+})
+h.equals("a password at the cap is still checked", crypt_calls, 1)
+unistd.crypt = real_crypt
+
 out, ret = run_action("authenticate-post", {
 	method = "POST",
 	body = "username=Alice&password=" .. url_encode(password),
-- 
cgit