You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by rn...@apache.org on 2014/04/06 19:35:44 UTC
couchdb commit: updated refs/heads/2221-bug-validate-auth-params to
887b420
Repository: couchdb
Updated Branches:
refs/heads/2221-bug-validate-auth-params [created] 887b42022
Verify that auth-related properties are well-formed
Passing unexpected values to auth fields can result in server
issues. Notably, setting "iterations" to a string will cause an
infinite loop as the comparison 'when Iteration > Iterations' will
never evaluate to false.
The latest validate_doc_update prevents user docs with this problem
and administrators can deploy that check themselves (and only
administrators can edit design documents).
COUCHDB-2221
Project: http://git-wip-us.apache.org/repos/asf/couchdb/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb/commit/887b4202
Tree: http://git-wip-us.apache.org/repos/asf/couchdb/tree/887b4202
Diff: http://git-wip-us.apache.org/repos/asf/couchdb/diff/887b4202
Branch: refs/heads/2221-bug-validate-auth-params
Commit: 887b42022430b565f82d941042712d43b61761e8
Parents: 9f6a919
Author: Robert Newson <rn...@apache.org>
Authored: Sun Apr 6 18:31:15 2014 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Sun Apr 6 18:31:15 2014 +0100
----------------------------------------------------------------------
src/couchdb/couch_passwords.erl | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb/blob/887b4202/src/couchdb/couch_passwords.erl
----------------------------------------------------------------------
diff --git a/src/couchdb/couch_passwords.erl b/src/couchdb/couch_passwords.erl
index d9e6836..bbf6d9a 100644
--- a/src/couchdb/couch_passwords.erl
+++ b/src/couchdb/couch_passwords.erl
@@ -22,12 +22,12 @@
%% legacy scheme, not used for new passwords.
-spec simple(binary(), binary()) -> binary().
-simple(Password, Salt) ->
+simple(Password, Salt) when is_binary(Password), is_binary(Salt) ->
?l2b(couch_util:to_hex(crypto:sha(<<Password/binary, Salt/binary>>))).
%% CouchDB utility functions
-spec hash_admin_password(binary()) -> binary().
-hash_admin_password(ClearPassword) ->
+hash_admin_password(ClearPassword) when is_binary(ClearPassword) ->
Iterations = couch_config:get("couch_httpd_auth", "iterations", "10000"),
Salt = couch_uuids:random(),
DerivedKey = couch_passwords:pbkdf2(couch_util:to_binary(ClearPassword),
@@ -50,7 +50,10 @@ get_unhashed_admins() ->
%% Current scheme, much stronger.
-spec pbkdf2(binary(), binary(), integer()) -> binary().
-pbkdf2(Password, Salt, Iterations) ->
+pbkdf2(Password, Salt, Iterations) when is_binary(Password),
+ is_binary(Salt),
+ is_integer(Iterations),
+ Iterations > 0 ->
{ok, Result} = pbkdf2(Password, Salt, Iterations, ?SHA1_OUTPUT_LENGTH),
Result.
@@ -59,7 +62,11 @@ pbkdf2(Password, Salt, Iterations) ->
pbkdf2(_Password, _Salt, _Iterations, DerivedLength)
when DerivedLength > ?MAX_DERIVED_KEY_LENGTH ->
{error, derived_key_too_long};
-pbkdf2(Password, Salt, Iterations, DerivedLength) ->
+pbkdf2(Password, Salt, Iterations, DerivedLength) when is_binary(Password),
+ is_binary(Salt),
+ is_integer(Iterations),
+ Iterations > 0,
+ is_integer(DerivedLength) ->
L = ceiling(DerivedLength / ?SHA1_OUTPUT_LENGTH),
<<Bin:DerivedLength/binary,_/binary>> =
iolist_to_binary(pbkdf2(Password, Salt, Iterations, L, 1, [])),