mirror of
https://github.com/argoproj/argo-cd
synced 2026-05-04 23:28:20 +00:00
685a814f38
* Add auth check and bypass for authentication * Disallow blank passwords * Mitigate timing attacks * Factor out authentication/token gen code * Tweaked token validation code to log claims * Add missing internal gRPC client endpoints * Add first draft of login command * Add login command to root commands * Get login working * Generalize command utils for unmarshaling * Centralize utils for CLI YAML/JSON parsing * Read/write local config now * Initialize map * Revert server files for now * Fix casing * Restore commented test, thanks @alexmt * No need to mitigate timing attacks on blank passwords, thanks @alexmt * Rm redundant type declaration, thanks @alexmt * Improve error checks * Rm unnecessary conversion, thanks @alexmt * Fix comment * Don't return error when config doesn't exist
68 lines
2.1 KiB
Go
68 lines
2.1 KiB
Go
package password
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func testPasswordHasher(t *testing.T, h PasswordHasher) {
|
|
// Use the default work factor
|
|
const (
|
|
defaultPassword = "Hello, world!"
|
|
pollution = "extradata12345"
|
|
)
|
|
hashedPassword, _ := h.HashPassword(defaultPassword)
|
|
if !h.VerifyPassword(defaultPassword, hashedPassword) {
|
|
t.Errorf("Password %q should have validated against hash %q", defaultPassword, hashedPassword)
|
|
}
|
|
if h.VerifyPassword(defaultPassword, pollution+hashedPassword) {
|
|
t.Errorf("Password %q should NOT have validated against hash %q", defaultPassword, pollution+hashedPassword)
|
|
}
|
|
}
|
|
|
|
func TestBcryptPasswordHasher(t *testing.T) {
|
|
// Use the default work factor
|
|
h := BcryptPasswordHasher{0}
|
|
testPasswordHasher(t, h)
|
|
}
|
|
|
|
func TestDummyPasswordHasher(t *testing.T) {
|
|
h := DummyPasswordHasher{}
|
|
testPasswordHasher(t, h)
|
|
}
|
|
|
|
func TestPasswordHashing(t *testing.T) {
|
|
const (
|
|
defaultPassword = "Hello, world!"
|
|
blankPassword = ""
|
|
)
|
|
hashers := []PasswordHasher{
|
|
BcryptPasswordHasher{0},
|
|
DummyPasswordHasher{},
|
|
}
|
|
|
|
hashedPassword, _ := hashPasswordWithHashers(defaultPassword, hashers)
|
|
valid, stale := verifyPasswordWithHashers(defaultPassword, hashedPassword, hashers)
|
|
if !valid {
|
|
t.Errorf("Password %q should have validated against hash %q", defaultPassword, hashedPassword)
|
|
}
|
|
if stale {
|
|
t.Errorf("Password %q should not have been marked stale against hash %q", defaultPassword, hashedPassword)
|
|
}
|
|
valid, stale = verifyPasswordWithHashers(defaultPassword, defaultPassword, hashers)
|
|
if !valid {
|
|
t.Errorf("Password %q should have validated against itself with dummy hasher", defaultPassword)
|
|
}
|
|
if !stale {
|
|
t.Errorf("Password %q should have been acknowledged stale against itself with dummy hasher", defaultPassword)
|
|
}
|
|
|
|
hashedPassword, err := hashPasswordWithHashers(blankPassword, hashers)
|
|
if err == nil {
|
|
t.Errorf("Blank password should have produced error, rather than hash %q", hashedPassword)
|
|
}
|
|
|
|
valid, _ = verifyPasswordWithHashers(blankPassword, "", hashers)
|
|
if valid != false {
|
|
t.Errorf("Blank password should have failed verification")
|
|
}
|
|
}
|