feat: cover 100% of crypto with tests #1892
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hf
commented
Dec 24, 2024
| @@ -382,3 +380,26 @@ func (a *API) runHook(r *http.Request, conn *storage.Connection, hookConfig conf | |||
|
|
|||
| return response, nil | |||
| } | |||
|
|
|||
| func generateSignatures(secrets []string, msgID uuid.UUID, currentTime time.Time, inputPayload []byte) ([]string, error) { | |||
There was a problem hiding this comment.
Moved this here since it seemed off in crypto.
Pull Request Test Coverage Report for Build 12485140393Details
💛 - Coveralls |
hf
force-pushed
the
hf/cover-crypto-100
branch
2 times, most recently
from
b667a3d to
14b0ec5
Compare
hf
force-pushed
the
hf/cover-crypto-100
branch
from
14b0ec5 to
b1a9f64
Compare
J0
reviewed
Dec 30, 2024
| var argon2HashRegexp = regexp.MustCompile("^[$](?P<alg>argon2(d|i|id))[$]v=(?P<v>(16|19))[$]m=(?P<m>[0-9]+),t=(?P<t>[0-9]+),p=(?P<p>[0-9]+)(,keyid=(?P<keyid>[^,$]+))?(,data=(?P<data>[^$]+))?[$](?P<salt>[^$]+)[$](?P<hash>.+)$") | ||
| var scryptHashRegexp = regexp.MustCompile(`^\$(?P<alg>fbscrypt)\$v=(?P<v>[0-9]+),n=(?P<n>[0-9]+),r=(?P<r>[0-9]+),p=(?P<p>[0-9]+)(?:,ss=(?P<ss>[^,]+))?(?:,sk=(?P<sk>[^$]+))?\$(?P<salt>[^$]+)\$(?P<hash>.+)$`) | ||
| var argon2HashRegexp = regexp.MustCompile("^[$](?P<alg>argon2(d|i|id))[$]v=(?P<v>(16|19))[$]m=(?P<m>[0-9]+),t=(?P<t>[0-9]+),p=(?P<p>[0-9]+)(,keyid=(?P<keyid>[^,$]+))?(,data=(?P<data>[^$]+))?[$](?P<salt>[^$]*)[$](?P<hash>.*)$") | ||
| var scryptHashRegexp = regexp.MustCompile(`^\$fbscrypt\$v=(?P<v>[0-9]+),n=(?P<n>[0-9]+),r=(?P<r>[0-9]+),p=(?P<p>[0-9]+)(?:,ss=(?P<ss>[^,]+))?(?:,sk=(?P<sk>[^$]+))?\$(?P<salt>[^$]+)\$(?P<hash>.+)$`) |
There was a problem hiding this comment.
Yup, we can have scrypt as a separate HashInput
/nit I guess perhaps a more appropriate name might be fbscryptHashRegexp? Though I guess that can be addressed if we do add scrypt support.
J0
reviewed
Dec 30, 2024
| rounds, err := strconv.ParseUint(r, 10, 64) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("crypto: Firebase scrypt hash has invalid r parameter %q: %w", r, err) | ||
| } | ||
| if rounds == 0 { |
There was a problem hiding this comment.
All for the additional safeguards, and defensive programming given this is a critical section for the auth system.
However, in case we ever end up digging into this section, here's were some of the initial considerations when going through the code
the current version of the library should panic if rounds == 0 or threads=0
https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.31.0:scrypt/scrypt.go;l=133
on this line since
in[(2*r-1)*16:] would equate to in[-16]
For threads=0 it should also return a division by 0 error :
if uint64(r)*uint64(p) >= 1<<30 || r > maxInt/128/p || r > maxInt/256 || N > maxInt/128/r {
return nil, errors.New("scrypt: parameters are too large")
}
cstockton
approved these changes
Jan 6, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Covers a 100% of the
cryptopackage with tests.