Files
@ 9a02f9ef28d7
Branch filter:
Location: kallithea/.travis.yml - annotation
9a02f9ef28d7
834 B
application/yaml
utils: make API key generator more random
The API key generator abused temporary filenames in what seems to be an attempt
of creating keys that unambiguously specified the user and thus were unique
across users. A final hashing did however remove that property.
More importantly, tempfile is not documented to use secure random numbers ...
and it only uses 6 characters, giving approximately 36 bits of entropy.
Instead, use the cryptographically secure os.urandom directly to generate keys
with the same length but with the full 160 bits of entropy.
Reported and fixed by Andrew Bartlett.
The API key generator abused temporary filenames in what seems to be an attempt
of creating keys that unambiguously specified the user and thus were unique
across users. A final hashing did however remove that property.
More importantly, tempfile is not documented to use secure random numbers ...
and it only uses 6 characters, giving approximately 36 bits of entropy.
Instead, use the cryptographically secure os.urandom directly to generate keys
with the same length but with the full 160 bits of entropy.
Reported and fixed by Andrew Bartlett.
6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 703d3208424c 703d3208424c 703d3208424c 6ccf86ebfd4e 925c77b9d3f1 925c77b9d3f1 925c77b9d3f1 925c77b9d3f1 6ccf86ebfd4e 6ccf86ebfd4e 703d3208424c 703d3208424c 63d3d20cad95 63d3d20cad95 63d3d20cad95 64ee7cf4a76d 63d3d20cad95 63d3d20cad95 63d3d20cad95 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 63d3d20cad95 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 13c0ab8eb343 08af8038e1cc 6ccf86ebfd4e 6ccf86ebfd4e 6ccf86ebfd4e 69377d1d7604 | language: python
python:
- "2.6"
- "2.7"
env:
- TEST_DB=sqlite:////tmp/kallithea_test.sqlite
- TEST_DB=mysql://root@127.0.0.1/kallithea_test
- TEST_DB=postgresql://postgres@127.0.0.1/kallithea_test
services:
- mysql
- postgresql
# command to install dependencies
before_script:
- mysql -e 'create database kallithea_test;'
- psql -c 'create database kallithea_test;' -U postgres
- git --version
before_install:
- sudo apt-get remove git
- sudo add-apt-repository ppa:pdoes/ppa -y
- sudo apt-get update -y
- sudo apt-get install git -y
install:
- pip install mysql-python psycopg2 mock unittest2
- pip install . --use-mirrors
# command to run tests
script: nosetests
notifications:
email:
- ci@kallithea-scm.org
irc: "irc.freenode.org#kallithea"
branches:
only:
- master
|