mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-22 17:16:24 +00:00
Code Issues 25 Releases Wiki Activity

Added test for acheck_password() to ensure make_password is called for unusable passwords.

Browse Source 
This is a follow up for the fix of CVE-2024-39329
(5d86458579) where the timing of
verify_password() was standardized when checking unusable passwords.
This commit is contained in:
Natalia 2024-08-08 11:29:00 -03:00 committed by nessita
parent f8ef4579ea
commit e1606d27b4
1 changed files with 41 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
tests/auth_tests/test_hashers.py
View File

@ -1,3 +1,4 @@
from contextlib import contextmanager
from unittest import mock, skipUnless from unittest import mock, skipUnless
from django.conf.global_settings import PASSWORD_HASHERS from django.conf.global_settings import PASSWORD_HASHERS
@ -452,8 +453,33 @@ class TestUtilsHashPass(SimpleTestCase):
check_password("wrong_password", encoded) check_password("wrong_password", encoded)
self.assertEqual(hasher.harden_runtime.call_count, 1) self.assertEqual(hasher.harden_runtime.call_count, 1)
def test_check_password_calls_make_password_to_fake_runtime(self): @contextmanager
def assertMakePasswordCalled(self, password, encoded, hasher_side_effect):
hasher = get_hasher("default") hasher = get_hasher("default")
with (
mock.patch(
"django.contrib.auth.hashers.identify_hasher",
side_effect=hasher_side_effect,
) as mock_identify_hasher,
mock.patch(
"django.contrib.auth.hashers.make_password"
) as mock_make_password,
mock.patch(
"django.contrib.auth.hashers.get_random_string",
side_effect=lambda size: "x" * size,
),
mock.patch.object(hasher, "verify"),
):
# Ensure make_password is called to standardize timing.
yield
self.assertEqual(hasher.verify.call_count, 0)
self.assertEqual(mock_identify_hasher.mock_calls, [mock.call(encoded)])
self.assertEqual(
mock_make_password.mock_calls,
[mock.call("x" * UNUSABLE_PASSWORD_SUFFIX_LENGTH)],
)
def test_check_password_calls_make_password_to_fake_runtime(self):
cases = [ cases = [
(None, None, None), # no plain text password provided (None, None, None), # no plain text password provided
("foo", make_password(password=None), None), # unusable encoded ("foo", make_password(password=None), None), # unusable encoded
@ -462,27 +488,22 @@ class TestUtilsHashPass(SimpleTestCase):
for password, encoded, hasher_side_effect in cases: for password, encoded, hasher_side_effect in cases:
with ( with (
self.subTest(encoded=encoded), self.subTest(encoded=encoded),
mock.patch( self.assertMakePasswordCalled(password, encoded, hasher_side_effect),
"django.contrib.auth.hashers.identify_hasher",
side_effect=hasher_side_effect,
) as mock_identify_hasher,
mock.patch(
"django.contrib.auth.hashers.make_password"
) as mock_make_password,
mock.patch(
"django.contrib.auth.hashers.get_random_string",
side_effect=lambda size: "x" * size,
),
mock.patch.object(hasher, "verify"),
): ):
# Ensure make_password is called to standardize timing.
check_password(password, encoded) check_password(password, encoded)
self.assertEqual(hasher.verify.call_count, 0)
self.assertEqual(mock_identify_hasher.mock_calls, [mock.call(encoded)]) async def test_acheck_password_calls_make_password_to_fake_runtime(self):
self.assertEqual( cases = [
mock_make_password.mock_calls, (None, None, None), # no plain text password provided
[mock.call("x" * UNUSABLE_PASSWORD_SUFFIX_LENGTH)], ("foo", make_password(password=None), None), # unusable encoded
) ("letmein", make_password(password="letmein"), ValueError), # valid encoded
]
for password, encoded, hasher_side_effect in cases:
with (
self.subTest(encoded=encoded),
self.assertMakePasswordCalled(password, encoded, hasher_side_effect),
):
await acheck_password(password, encoded)
def test_encode_invalid_salt(self): def test_encode_invalid_salt(self):
hasher_classes = [ hasher_classes = [