burmatovan/openuds
1
0
Fork 0
forked from shaba/openuds
Code Issues Pull Requests Projects Releases Wiki Activity

Improved internaldb password security (sha3_256) and added extra security to uds cookie

Browse Source
This commit is contained in:
Adolfo Gómez García 2021-05-21 11:38:41 +02:00
parent f39bc9c5ba
commit 1050ada43b
3 changed files with 22 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
server/src/uds/auths/InternalDB/authenticator.py
View File

@ -111,9 +111,8 @@ class InternalDBAuth(auths.Authenticator):
if user.parent: # Direct auth not allowed for "derived" users
return False
# Internal Db Auth has its own groups, and if it active it is valid
if user.password == cryptoManager().hash(credentials):
# hashlib.sha1(credentials.encode('utf-8')).hexdigest():
# Internal Db Auth has its own groups. (That is, no external source). If a group is active it is valid
if cryptoManager().checkHash(credentials, user.password):
groupsManager.validate([g.name for g in user.groups.all()])
return True
return False

5
server/src/uds/core/auths/auth.py
View File

@ -71,6 +71,7 @@ USER_KEY = 'uk'
PASS_KEY = 'pk'
EXPIRY_KEY = 'ek'
ROOT_ID = -20091204 # Any negative number will do the trick
UDS_COOKIE_LENGTH = 48
RT = typing.TypeVar('RT')
@ -84,12 +85,12 @@ def getUDSCookie(
Generates a random cookie for uds, used, for example, to encript things
"""
if 'uds' not in request.COOKIES:
cookie = cryptoManager().randomString(48)
cookie = cryptoManager().randomString(UDS_COOKIE_LENGTH)
if response is not None:
response.set_cookie('uds', cookie, samesite='Lax')
request.COOKIES['uds'] = cookie
else:
cookie = request.COOKIES['uds']
cookie = request.COOKIES['uds'][:UDS_COOKIE_LENGTH]
if response and force:
response.set_cookie('uds', cookie)

22
server/src/uds/core/managers/crypto.py
View File

@ -87,7 +87,7 @@ class CryptoManager:
def encrypt(self, value: str) -> str:
return codecs.encode(
self._rsa.public_key().encrypt(
self._rsa.public_key().encrypt( # type: ignore
value.encode(),
padding.OAEP(
mgf=padding.MGF1(algorithm=hashes.SHA256()),
@ -103,7 +103,7 @@ class CryptoManager:
try:
# First, try new "cryptografy" decrpypting
decrypted: bytes = self._rsa.decrypt(
decrypted: bytes = self._rsa.decrypt( # type: ignore
data,
padding.OAEP(
mgf=padding.MGF1(algorithm=hashes.SHA256()),
@ -221,12 +221,24 @@ class CryptoManager:
def hash(self, value: typing.Union[str, bytes]) -> str:
if isinstance(value, str):
value = value.encode('utf-8')
value = value.encode()
if not value:
return ''
return str(hashlib.sha1(value).hexdigest())
return '{SHA256}' + str(hashlib.sha3_256(value).hexdigest())
def checkHash(self, value: typing.Union[str, bytes], hash: str) -> bool:
if isinstance(value, str):
value = value.encode()
if not value:
return not hash
if hash[:8] == '{SHA256}':
return str(hashlib.sha3_256(value).hexdigest()) == hash[8:]
else: # Old sha1
return hash == str(hashlib.sha1(value).hexdigest())
def uuid(self, obj: typing.Any = None) -> str:
"""
@ -246,5 +258,5 @@ class CryptoManager:
).lower() # I believe uuid returns a lowercase uuid always, but in case... :)
def randomString(self, length: int = 40, digits: bool = True) -> str:
base = string.ascii_lowercase + (string.digits if digits else '')
base = string.ascii_letters + (string.digits if digits else '')
return ''.join(random.SystemRandom().choices(base, k=length))