mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-08 15:41:15 +02:00
Chris Lu
3cdfe648eb
ValidatePassword compared the stored and supplied passwords with subtle.ConstantTimeCompare, which returns 1 for two zero-length slices. A user provisioned for public-key-only auth has an empty stored password, so an empty supplied password authenticated as that user whenever "password" was among the enabled auth methods (the default). Treat an empty stored or supplied password as a non-match. Claude-Session: https://claude.ai/code/session_011QqNaxZwnpHgMoAZNp3RkY
37 lines
978 B
Go
37 lines
978 B
Go
package user
|
|
|
|
import "testing"
|
|
|
|
func newTestStore(users ...*User) *FileStore {
|
|
s := &FileStore{users: make(map[string]*User)}
|
|
for _, u := range users {
|
|
s.users[u.Username] = u
|
|
}
|
|
return s
|
|
}
|
|
|
|
func TestValidatePasswordRejectsEmpty(t *testing.T) {
|
|
s := newTestStore(
|
|
&User{Username: "keyonly", Password: "", PublicKeys: []string{"ssh-ed25519 AAAA"}},
|
|
&User{Username: "haspass", Password: "s3cret"},
|
|
)
|
|
|
|
cases := []struct {
|
|
username string
|
|
password string
|
|
want bool
|
|
}{
|
|
{"keyonly", "", false}, // public-key-only user must not accept an empty password
|
|
{"keyonly", "wrong", false},
|
|
{"haspass", "", false}, // a real password is never matched by an empty one
|
|
{"haspass", "s3cret", true},
|
|
{"haspass", "wrong", false},
|
|
{"missing", "", false},
|
|
}
|
|
for _, c := range cases {
|
|
if got := s.ValidatePassword(c.username, []byte(c.password)); got != c.want {
|
|
t.Errorf("ValidatePassword(%q, %q) = %v, want %v", c.username, c.password, got, c.want)
|
|
}
|
|
}
|
|
}
|