forgejo/modules/util
Gusted 623c93ff46
Increase Salt randomness (#18179)
- The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit.
- The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness.
- Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16).
- When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt.

Thanks to @zeripath for working out the rouge edges from my first commit 😄.

Co-authored-by: lafriks <lauris@nix.lv>
Co-authored-by: zeripath <art27@cantab.net>
2022-01-04 15:13:52 +00:00
..
compare.go Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
copy.go migrate from com.* to alternatives (#14103) 2020-12-25 11:59:32 +02:00
io.go Read expected buffer size (#17409) 2021-10-24 22:12:43 +01:00
net.go Only allow webhook to send requests to allowed hosts (#17482) 2021-11-01 16:39:52 +08:00
paginate.go [API] Add pagination to ListBranches (#14524) 2021-02-03 20:06:13 +01:00
paginate_test.go [API] Add pagination to ListBranches (#14524) 2021-02-03 20:06:13 +01:00
path.go Include folders into size cost (#18158) 2022-01-03 23:24:12 +00:00
path_test.go Add LFS Migration and Mirror (#14726) 2021-04-08 18:25:57 -04:00
remove.go Make cancel from CatFileBatch and CatFileBatchCheck wait for the command to end (#16479) 2021-07-20 20:23:01 +03:00
sanitize.go Add push to remote mirror repository (#15157) 2021-06-14 19:20:43 +02:00
sanitize_test.go Add push to remote mirror repository (#15157) 2021-06-14 19:20:43 +02:00
shellquote.go Completely quote AppPath and CustomConf paths (#12955) 2020-09-28 21:16:52 -04:00
shellquote_test.go Fix various documentation, user-facing, and source comment typos (#16367) 2021-07-08 13:38:13 +02:00
timer.go Prevent timer leaks in Workerpool and others (#11333) 2020-05-08 16:46:05 +01:00
truncate.go Fix a panic in NotifyCreateIssueComment (caused by string truncation) (#17928) 2021-12-09 05:41:17 +00:00
truncate_test.go Fix a panic in NotifyCreateIssueComment (caused by string truncation) (#17928) 2021-12-09 05:41:17 +00:00
url.go Re-attempt to delete temporary upload if the file is locked by another process (#12447) 2020-08-11 21:05:34 +01:00
util.go Increase Salt randomness (#18179) 2022-01-04 15:13:52 +00:00
util_test.go Increase Salt randomness (#18179) 2022-01-04 15:13:52 +00:00