Projet

Général

Profil

0001-misc-do-not-trace-on-invalid-HTTP-auth-42784.patch

Benjamin Dauvergne, 12 mai 2020 19:02

Télécharger (4,56 ko)

Voir les différences: 

Subject: [PATCH] misc: do not trace on invalid HTTP auth (#42784)


 passerelle/utils/__init__.py | 15 ++++++--
 tests/test_utils.py          | 71 ++++++++++++++++++++++++++++++++++++
 2 files changed, 82 insertions(+), 4 deletions(-)
 create mode 100644 tests/test_utils.py
passerelle/utils/__init__.py
78 78 
        users.extend(ApiUser.objects.filter(keytype='API', key=request.GET['apikey']))
79 79 

  		




  80
  80
  
    
    elif 'HTTP_AUTHORIZATION' in request.META:

  		




  81
  
  
    
        (scheme, param) = request.META['HTTP_AUTHORIZATION'].split(' ', 1)

  		




  82
  
  
    
        if scheme.lower() == 'basic':

  		




  83
  
  
    
            username, password = force_text(base64.b64decode(force_bytes(param.strip()))).split(':', 1)

  		




  84
  
  
    
            users.extend(ApiUser.objects.filter(keytype='SIGN', username=username, key=password))

  		




  
  81
  
    
        http_authorization = request.META['HTTP_AUTHORIZATION'].split(' ', 1)

  		




  
  82
  
    
        scheme = http_authorization[0].lower()

  		




  
  83
  
    
        if scheme == 'basic' and len(http_authorization) > 1:

  		




  
  84
  
    
            param = http_authorization[1]

  		




  
  85
  
    
            try:

  		




  
  86
  
    
                decoded = force_text(base64.b64decode(force_bytes(param.strip())))

  		




  
  87
  
    
                username, password = decoded.split(':', 1)

  		




  
  88
  
    
            except (TypeError, ValueError):

  		




  
  89
  
    
                pass

  		




  
  90
  
    
            else:

  		




  
  91
  
    
                users.extend(ApiUser.objects.filter(keytype='SIGN', username=username, key=password))

  		




  85
  92
  
    

  		




  86
  93
  
    
    def ip_match(ip, match):

  		




  87
  94
  
    
        if not ip:

  		












  

    
      tests/test_utils.py
    
  





  
  1
  
    
# Copyright (C) 2019  Entr'ouvert

  		




  
  2
  
    
#

  		




  
  3
  
    
# This program is free software: you can redistribute it and/or modify it

  		




  
  4
  
    
# under the terms of the GNU Affero General Public License as published

  		




  
  5
  
    
# by the Free Software Foundation, either version 3 of the License, or

  		




  
  6
  
    
# (at your option) any later version.

  		




  
  7
  
    
#

  		




  
  8
  
    
# This program is distributed in the hope that it will be useful,

  		




  
  9
  
    
# but WITHOUT ANY WARRANTY; without even the implied warranty of

  		




  
  10
  
    
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

  		




  
  11
  
    
# GNU Affero General Public License for more details.

  		




  
  12
  
    
#

  		




  
  13
  
    
# You should have received a copy of the GNU Affero General Public License

  		




  
  14
  
    
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

  		




  
  15
  
    

  		




  
  16
  
    
import base64

  		




  
  17
  
    

  		




  
  18
  
    
from django.utils.encoding import force_str

  		




  
  19
  
    

  		




  
  20
  
    
from passerelle.base.models import ApiUser

  		




  
  21
  
    
from passerelle.base.signature import sign_query

  		




  
  22
  
    
from passerelle.utils import get_request_users

  		




  
  23
  
    

  		




  
  24
  
    

  		




  
  25
  
    
def test_get_request_users_publik_signature(db, rf):

  		




  
  26
  
    
    request = rf.get('/?' + sign_query('orig=orig', key='publikkey'))

  		




  
  27
  
    
    assert get_request_users(request) == []

  		




  
  28
  
    

  		




  
  29
  
    
    api_user = ApiUser.objects.create(keytype='SIGN', username='orig', key='publikkey')

  		




  
  30
  
    
    assert get_request_users(request) == [api_user]

  		




  
  31
  
    

  		




  
  32
  
    
    request = rf.get('/?orig=orig&signature=xxx')

  		




  
  33
  
    
    assert get_request_users(request) == []

  		




  
  34
  
    

  		




  
  35
  
    

  		




  
  36
  
    
def test_get_request_users_apikey(db, rf):

  		




  
  37
  
    
    request = rf.get('/', data={'apikey': 'apikey'})

  		




  
  38
  
    
    assert get_request_users(request) == []

  		




  
  39
  
    

  		




  
  40
  
    
    api_user = ApiUser.objects.create(keytype='API', key='apikey')

  		




  
  41
  
    
    assert get_request_users(request) == [api_user]

  		




  
  42
  
    

  		




  
  43
  
    

  		




  
  44
  
    
def test_get_request_users_http_auth_basic(db, rf):

  		




  
  45
  
    
    api_user = ApiUser.objects.create(keytype='SIGN', username='john', key='password')

  		




  
  46
  
    
    encoded = force_str(base64.b64encode(b'john:password'))

  		




  
  47
  
    
    request = rf.get('/', HTTP_AUTHORIZATION='Basic ' + encoded)

  		




  
  48
  
    
    assert get_request_users(request) == [api_user]

  		




  
  49
  
    

  		




  
  50
  
    

  		




  
  51
  
    
def test_get_request_users_http_auth_invalid(db, rf):

  		




  
  52
  
    
    request = rf.get('/', HTTP_AUTHORIZATION='')

  		




  
  53
  
    
    assert get_request_users(request) == []

  		




  
  54
  
    

  		




  
  55
  
    
    # no param

  		




  
  56
  
    
    request = rf.get('/', HTTP_AUTHORIZATION='Basic')

  		




  
  57
  
    
    assert get_request_users(request) == []

  		




  
  58
  
    

  		




  
  59
  
    
    # invalid base64

  		




  
  60
  
    
    request = rf.get('/', HTTP_AUTHORIZATION='Basic xx')

  		




  
  61
  
    
    assert get_request_users(request) == []

  		




  
  62
  
    

  		




  
  63
  
    
    # missing : in decoded base64

  		




  
  64
  
    
    request = rf.get('/', HTTP_AUTHORIZATION='Basic ' + force_str(base64.b64encode(b'x')))

  		




  
  65
  
    
    assert get_request_users(request) == []

  		




  
  66
  
    

  		




  
  67
  
    
    # other schemes are ignored

  		




  
  68
  
    
    request = rf.get('/', HTTP_AUTHORIZATION='Bearer')

  		




  
  69
  
    
    assert get_request_users(request) == []

  		




  
  70
  
    
    request = rf.get('/', HTTP_AUTHORIZATION='Digest kjkjlkjlkjljlkj')

  		




  
  71
  
    
    assert get_request_users(request) == []

  		




  0
  
  
    
-