Consume hcaptcha and pwn deps (#22610)
This PR just consumes the [hcaptcha](https://gitea.com/jolheiser/hcaptcha) and [haveibeenpwned](https://gitea.com/jolheiser/pwn) modules directly into Gitea. Also let this serve as a notice that I'm fine with transferring my license (which was already MIT) from my own name to "The Gitea Authors". Signed-off-by: jolheiser <john.olheiser@gmail.com>release
John Olheiser
GitHub
parent
e88b529b31
commit
2052a9e2b4
@ -0,0 +1,47 @@
|
||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package hcaptcha
|
||||
|
||||
const (
|
||||
ErrMissingInputSecret ErrorCode = "missing-input-secret"
|
||||
ErrInvalidInputSecret ErrorCode = "invalid-input-secret"
|
||||
ErrMissingInputResponse ErrorCode = "missing-input-response"
|
||||
ErrInvalidInputResponse ErrorCode = "invalid-input-response"
|
||||
ErrBadRequest ErrorCode = "bad-request"
|
||||
ErrInvalidOrAlreadySeenResponse ErrorCode = "invalid-or-already-seen-response"
|
||||
ErrNotUsingDummyPasscode ErrorCode = "not-using-dummy-passcode"
|
||||
ErrSitekeySecretMismatch ErrorCode = "sitekey-secret-mismatch"
|
||||
)
|
||||
|
||||
// ErrorCode is any possible error from hCaptcha
|
||||
type ErrorCode string
|
||||
|
||||
// String fulfills the Stringer interface
|
||||
func (err ErrorCode) String() string {
|
||||
switch err {
|
||||
case ErrMissingInputSecret:
|
||||
return "Your secret key is missing."
|
||||
case ErrInvalidInputSecret:
|
||||
return "Your secret key is invalid or malformed."
|
||||
case ErrMissingInputResponse:
|
||||
return "The response parameter (verification token) is missing."
|
||||
case ErrInvalidInputResponse:
|
||||
return "The response parameter (verification token) is invalid or malformed."
|
||||
case ErrBadRequest:
|
||||
return "The request is invalid or malformed."
|
||||
case ErrInvalidOrAlreadySeenResponse:
|
||||
return "The response parameter has already been checked, or has another issue."
|
||||
case ErrNotUsingDummyPasscode:
|
||||
return "You have used a testing sitekey but have not used its matching secret."
|
||||
case ErrSitekeySecretMismatch:
|
||||
return "The sitekey is not registered with the provided secret."
|
||||
default:
|
||||
return ""
|
||||
}
|
||||
}
|
||||
|
||||
// Error fulfills the error interface
|
||||
func (err ErrorCode) Error() string {
|
||||
return err.String()
|
||||
}
|
||||
@ -0,0 +1,106 @@
|
||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package hcaptcha
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
dummySiteKey = "10000000-ffff-ffff-ffff-000000000001"
|
||||
dummySecret = "0x0000000000000000000000000000000000000000"
|
||||
dummyToken = "10000000-aaaa-bbbb-cccc-000000000001"
|
||||
)
|
||||
|
||||
func TestMain(m *testing.M) {
|
||||
os.Exit(m.Run())
|
||||
}
|
||||
|
||||
func TestCaptcha(t *testing.T) {
|
||||
tt := []struct {
|
||||
Name string
|
||||
Secret string
|
||||
Token string
|
||||
Error ErrorCode
|
||||
}{
|
||||
{
|
||||
Name: "Success",
|
||||
Secret: dummySecret,
|
||||
Token: dummyToken,
|
||||
},
|
||||
{
|
||||
Name: "Missing Secret",
|
||||
Token: dummyToken,
|
||||
Error: ErrMissingInputSecret,
|
||||
},
|
||||
{
|
||||
Name: "Missing Token",
|
||||
Secret: dummySecret,
|
||||
Error: ErrMissingInputResponse,
|
||||
},
|
||||
{
|
||||
Name: "Invalid Token",
|
||||
Secret: dummySecret,
|
||||
Token: "test",
|
||||
Error: ErrInvalidInputResponse,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range tt {
|
||||
t.Run(tc.Name, func(t *testing.T) {
|
||||
client, err := New(tc.Secret, WithHTTP(&http.Client{
|
||||
Timeout: time.Second * 5,
|
||||
}))
|
||||
if err != nil {
|
||||
// The only error that can be returned from creating a client
|
||||
if tc.Error == ErrMissingInputSecret && err == ErrMissingInputSecret {
|
||||
return
|
||||
}
|
||||
t.Log(err)
|
||||
t.FailNow()
|
||||
}
|
||||
|
||||
resp, err := client.Verify(tc.Token, PostOptions{
|
||||
Sitekey: dummySiteKey,
|
||||
})
|
||||
if err != nil {
|
||||
// The only error that can be returned prior to the request
|
||||
if tc.Error == ErrMissingInputResponse && err == ErrMissingInputResponse {
|
||||
return
|
||||
}
|
||||
t.Log(err)
|
||||
t.FailNow()
|
||||
}
|
||||
|
||||
if tc.Error.String() != "" {
|
||||
if resp.Success {
|
||||
t.Log("Verification should fail.")
|
||||
t.Fail()
|
||||
}
|
||||
if len(resp.ErrorCodes) == 0 {
|
||||
t.Log("hCaptcha should have returned an error.")
|
||||
t.Fail()
|
||||
}
|
||||
var hasErr bool
|
||||
for _, err := range resp.ErrorCodes {
|
||||
if strings.EqualFold(err.String(), tc.Error.String()) {
|
||||
hasErr = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !hasErr {
|
||||
t.Log("hCaptcha did not return the error being tested")
|
||||
t.Fail()
|
||||
}
|
||||
} else if !resp.Success {
|
||||
t.Log("Verification should succeed.")
|
||||
t.Fail()
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,118 @@
|
||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package pwn
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/sha1"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"code.gitea.io/gitea/modules/setting"
|
||||
)
|
||||
|
||||
const passwordURL = "https://api.pwnedpasswords.com/range/"
|
||||
|
||||
// ErrEmptyPassword is an empty password error
|
||||
var ErrEmptyPassword = errors.New("password cannot be empty")
|
||||
|
||||
// Client is a HaveIBeenPwned client
|
||||
type Client struct {
|
||||
ctx context.Context
|
||||
http *http.Client
|
||||
}
|
||||
|
||||
// New returns a new HaveIBeenPwned Client
|
||||
func New(options ...ClientOption) *Client {
|
||||
client := &Client{
|
||||
ctx: context.Background(),
|
||||
http: http.DefaultClient,
|
||||
}
|
||||
|
||||
for _, opt := range options {
|
||||
opt(client)
|
||||
}
|
||||
|
||||
return client
|
||||
}
|
||||
|
||||
// ClientOption is a way to modify a new Client
|
||||
type ClientOption func(*Client)
|
||||
|
||||
// WithHTTP will set the http.Client of a Client
|
||||
func WithHTTP(httpClient *http.Client) func(pwnClient *Client) {
|
||||
return func(pwnClient *Client) {
|
||||
pwnClient.http = httpClient
|
||||
}
|
||||
}
|
||||
|
||||
// WithContext will set the context.Context of a Client
|
||||
func WithContext(ctx context.Context) func(pwnClient *Client) {
|
||||
return func(pwnClient *Client) {
|
||||
pwnClient.ctx = ctx
|
||||
}
|
||||
}
|
||||
|
||||
func newRequest(ctx context.Context, method, url string, body io.ReadCloser) (*http.Request, error) {
|
||||
req, err := http.NewRequestWithContext(ctx, method, url, body)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
req.Header.Add("User-Agent", "Gitea "+setting.AppVer)
|
||||
return req, nil
|
||||
}
|
||||
|
||||
// CheckPassword returns the number of times a password has been compromised
|
||||
// Adding padding will make requests more secure, however is also slower
|
||||
// because artificial responses will be added to the response
|
||||
// For more information, see https://www.troyhunt.com/enhancing-pwned-passwords-privacy-with-padding/
|
||||
func (c *Client) CheckPassword(pw string, padding bool) (int, error) {
|
||||
if strings.TrimSpace(pw) == "" {
|
||||
return -1, ErrEmptyPassword
|
||||
}
|
||||
|
||||
sha := sha1.New()
|
||||
sha.Write([]byte(pw))
|
||||
enc := hex.EncodeToString(sha.Sum(nil))
|
||||
prefix, suffix := enc[:5], enc[5:]
|
||||
|
||||
req, err := newRequest(c.ctx, http.MethodGet, fmt.Sprintf("%s%s", passwordURL, prefix), nil)
|
||||
if err != nil {
|
||||
return -1, nil
|
||||
}
|
||||
if padding {
|
||||
req.Header.Add("Add-Padding", "true")
|
||||
}
|
||||
|
||||
resp, err := c.http.Do(req)
|
||||
if err != nil {
|
||||
return -1, err
|
||||
}
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return -1, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
for _, pair := range strings.Split(string(body), "\n") {
|
||||
parts := strings.Split(pair, ":")
|
||||
if len(parts) != 2 {
|
||||
continue
|
||||
}
|
||||
if strings.EqualFold(suffix, parts[0]) {
|
||||
count, err := strconv.ParseInt(strings.TrimSpace(parts[1]), 10, 64)
|
||||
if err != nil {
|
||||
return -1, err
|
||||
}
|
||||
return int(count), nil
|
||||
}
|
||||
}
|
||||
return 0, nil
|
||||
}
|
||||
@ -0,0 +1,142 @@
|
||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package pwn
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"math/rand"
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
var client = New(WithHTTP(&http.Client{
|
||||
Timeout: time.Second * 2,
|
||||
}))
|
||||
|
||||
func TestMain(m *testing.M) {
|
||||
rand.Seed(time.Now().Unix())
|
||||
os.Exit(m.Run())
|
||||
}
|
||||
|
||||
func TestPassword(t *testing.T) {
|
||||
// Check input error
|
||||
_, err := client.CheckPassword("", false)
|
||||
if err == nil {
|
||||
t.Log("blank input should return an error")
|
||||
t.Fail()
|
||||
}
|
||||
if !errors.Is(err, ErrEmptyPassword) {
|
||||
t.Log("blank input should return ErrEmptyPassword")
|
||||
t.Fail()
|
||||
}
|
||||
|
||||
// Should fail
|
||||
fail := "password1234"
|
||||
count, err := client.CheckPassword(fail, false)
|
||||
if err != nil {
|
||||
t.Log(err)
|
||||
t.Fail()
|
||||
}
|
||||
if count == 0 {
|
||||
t.Logf("%s should fail as a password\n", fail)
|
||||
t.Fail()
|
||||
}
|
||||
|
||||
// Should fail (with padding)
|
||||
failPad := "administrator"
|
||||
count, err = client.CheckPassword(failPad, true)
|
||||
if err != nil {
|
||||
t.Log(err)
|
||||
t.Fail()
|
||||
}
|
||||
if count == 0 {
|
||||
t.Logf("%s should fail as a password\n", failPad)
|
||||
t.Fail()
|
||||
}
|
||||
|
||||
// Checking for a "good" password isn't going to be perfect, but we can give it a good try
|
||||
// with hopefully minimal error. Try five times?
|
||||
var good bool
|
||||
var pw string
|
||||
for idx := 0; idx <= 5; idx++ {
|
||||
pw = testPassword()
|
||||
count, err = client.CheckPassword(pw, false)
|
||||
if err != nil {
|
||||
t.Log(err)
|
||||
t.Fail()
|
||||
}
|
||||
if count == 0 {
|
||||
good = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !good {
|
||||
t.Log("no generated passwords passed. there is a chance this is a fluke")
|
||||
t.Fail()
|
||||
}
|
||||
|
||||
// Again, but with padded responses
|
||||
good = false
|
||||
for idx := 0; idx <= 5; idx++ {
|
||||
pw = testPassword()
|
||||
count, err = client.CheckPassword(pw, true)
|
||||
if err != nil {
|
||||
t.Log(err)
|
||||
t.Fail()
|
||||
}
|
||||
if count == 0 {
|
||||
good = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !good {
|
||||
t.Log("no generated passwords passed. there is a chance this is a fluke")
|
||||
t.Fail()
|
||||
}
|
||||
}
|
||||
|
||||
// Credit to https://golangbyexample.com/generate-random-password-golang/
|
||||
// DO NOT USE THIS FOR AN ACTUAL PASSWORD GENERATOR
|
||||
var (
|
||||
lowerCharSet = "abcdedfghijklmnopqrst"
|
||||
upperCharSet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
|
||||
specialCharSet = "!@#$%&*"
|
||||
numberSet = "0123456789"
|
||||
allCharSet = lowerCharSet + upperCharSet + specialCharSet + numberSet
|
||||
)
|
||||
|
||||
func testPassword() string {
|
||||
var password strings.Builder
|
||||
|
||||
// Set special character
|
||||
for i := 0; i < 5; i++ {
|
||||
random := rand.Intn(len(specialCharSet))
|
||||
password.WriteString(string(specialCharSet[random]))
|
||||
}
|
||||
|
||||
// Set numeric
|
||||
for i := 0; i < 5; i++ {
|
||||
random := rand.Intn(len(numberSet))
|
||||
password.WriteString(string(numberSet[random]))
|
||||
}
|
||||
|
||||
// Set uppercase
|
||||
for i := 0; i < 5; i++ {
|
||||
random := rand.Intn(len(upperCharSet))
|
||||
password.WriteString(string(upperCharSet[random]))
|
||||
}
|
||||
|
||||
for i := 0; i < 5; i++ {
|
||||
random := rand.Intn(len(allCharSet))
|
||||
password.WriteString(string(allCharSet[random]))
|
||||
}
|
||||
inRune := []rune(password.String())
|
||||
rand.Shuffle(len(inRune), func(i, j int) {
|
||||
inRune[i], inRune[j] = inRune[j], inRune[i]
|
||||
})
|
||||
return string(inRune)
|
||||
}
|
||||
Loading…
Reference in New Issue