diff --git a/.env.example b/.env.example index 1f4e50b..f73d472 100644 --- a/.env.example +++ b/.env.example @@ -1,7 +1,7 @@ # API Options DECNET_API_HOST=0.0.0.0 DECNET_API_PORT=8000 -DECNET_JWT_SECRET=supersecretkey12345 +DECNET_JWT_SECRET=supersecretkey12345678901234567 DECNET_INGEST_LOG_FILE=/var/log/decnet/decnet.log # Web Dashboard Options diff --git a/.hypothesis/constants/9cb8bff6ac3080a0 b/.hypothesis/constants/9cb8bff6ac3080a0 new file mode 100644 index 0000000..0add520 --- /dev/null +++ b/.hypothesis/constants/9cb8bff6ac3080a0 @@ -0,0 +1,4 @@ +# file: /home/anti/Tools/DECNET/decnet/web/api.py +# hypothesis_version: 6.151.11 + +[400, 404, 500, 512, 1000, 1024, '*', '/api/v1/auth/login', '/api/v1/deckies', '/api/v1/logs', '/api/v1/stats', '/api/v1/stream', '1.0.0', 'Authorization', 'Bearer', 'Bearer ', 'Decky not found', 'No active deployment', 'WWW-Authenticate', 'access_token', 'admin', 'bearer', 'data', 'decnet.web.api', 'histogram', 'id', 'lastEventId', 'limit', 'logs', 'message', 'must_change_password', 'offset', 'password_hash', 'role', 'stats', 'text/event-stream', 'token', 'token_type', 'total', 'type', 'unihost', 'username', 'uuid'] \ No newline at end of file diff --git a/.hypothesis/constants/f9f2aace37ce402b b/.hypothesis/constants/f9f2aace37ce402b new file mode 100644 index 0000000..18ba47e --- /dev/null +++ b/.hypothesis/constants/f9f2aace37ce402b @@ -0,0 +1,4 @@ +# file: /home/anti/Tools/DECNET/decnet/web/auth.py +# hypothesis_version: 6.151.11 + +[1440, 'HS256', 'exp', 'iat', 'utf-8'] \ No newline at end of file diff --git a/.hypothesis/examples/04e6b3400353b141/ecc7e8764d8d8b88 b/.hypothesis/examples/04e6b3400353b141/ecc7e8764d8d8b88 new file mode 100644 index 0000000..27528ae --- /dev/null +++ b/.hypothesis/examples/04e6b3400353b141/ecc7e8764d8d8b88 @@ -0,0 +1 @@ +&@a!ޔ'_l.secondary \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/0ab7b4e709810141 b/.hypothesis/examples/ecc7e8764d8d8b88/0ab7b4e709810141 new file mode 100644 index 0000000..821e11f --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/0ab7b4e709810141 @@ -0,0 +1 @@ +J00000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/10d36a4958b401ae b/.hypothesis/examples/ecc7e8764d8d8b88/10d36a4958b401ae new file mode 100644 index 0000000..ac65c94 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/10d36a4958b401ae @@ -0,0 +1 @@ +Z000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/1da275fe3225e321 b/.hypothesis/examples/ecc7e8764d8d8b88/1da275fe3225e321 new file mode 100644 index 0000000..2134c2c --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/1da275fe3225e321 @@ -0,0 +1 @@ +U0000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/2a255fe9b75657fe b/.hypothesis/examples/ecc7e8764d8d8b88/2a255fe9b75657fe new file mode 100644 index 0000000..0467fba --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/2a255fe9b75657fe @@ -0,0 +1 @@ +L0000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/2d8090c00261b57e b/.hypothesis/examples/ecc7e8764d8d8b88/2d8090c00261b57e new file mode 100644 index 0000000..25eb4d0 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/2d8090c00261b57e @@ -0,0 +1 @@ +V00000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/35b25efe3721d07c b/.hypothesis/examples/ecc7e8764d8d8b88/35b25efe3721d07c new file mode 100644 index 0000000..9718c8f --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/35b25efe3721d07c @@ -0,0 +1 @@ +T000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/4b1fa71886354f75 b/.hypothesis/examples/ecc7e8764d8d8b88/4b1fa71886354f75 new file mode 100644 index 0000000..c5696f6 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/4b1fa71886354f75 @@ -0,0 +1 @@ +W000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/517b7281f484c8ea b/.hypothesis/examples/ecc7e8764d8d8b88/517b7281f484c8ea new file mode 100644 index 0000000..4c03c08 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/517b7281f484c8ea @@ -0,0 +1 @@ +Ω≈ç√∫˜µ≤≥÷åß∂ƒ©˙∆˚¬…æœ∑´®†¥¨ˆøπ“‘¡™£¢∞§¶•ªº–≠¸˛Ç◊ı˜Â¯˘¿ÅÍÎÏ˝ÓÔÒÚÆ☃Œ„´‰ˇÁ¨ˆØ∏”’`⁄€‹›fifl‡°·‚—± \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/566a0db223fc444e b/.hypothesis/examples/ecc7e8764d8d8b88/566a0db223fc444e new file mode 100644 index 0000000..1a5df11 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/566a0db223fc444e @@ -0,0 +1 @@ +M00000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/603b279e7467600c b/.hypothesis/examples/ecc7e8764d8d8b88/603b279e7467600c new file mode 100644 index 0000000..73fc542 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/603b279e7467600c @@ -0,0 +1 @@ +X0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/6376092996a87a12 b/.hypothesis/examples/ecc7e8764d8d8b88/6376092996a87a12 new file mode 100644 index 0000000..4c8d408 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/6376092996a87a12 @@ -0,0 +1 @@ +P00000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/7004a20627600ff5 b/.hypothesis/examples/ecc7e8764d8d8b88/7004a20627600ff5 new file mode 100644 index 0000000..502ad3d --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/7004a20627600ff5 @@ -0,0 +1 @@ +[0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/83b93eee5a197cdf b/.hypothesis/examples/ecc7e8764d8d8b88/83b93eee5a197cdf new file mode 100644 index 0000000..e25c5fa --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/83b93eee5a197cdf @@ -0,0 +1 @@ +Y00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/90a025b38717e89b b/.hypothesis/examples/ecc7e8764d8d8b88/90a025b38717e89b new file mode 100644 index 0000000..09c8295 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/90a025b38717e89b @@ -0,0 +1 @@ +Q000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/df65ee15e0244ff5 b/.hypothesis/examples/ecc7e8764d8d8b88/df65ee15e0244ff5 new file mode 100644 index 0000000..3f5cacb --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/df65ee15e0244ff5 @@ -0,0 +1 @@ +Ω≈ç√∫˜µ≤≥÷åß∂ƒ©˙∆˚¬…æœ∑´®†¥¨ˆøπ“‘¡™£¢∞§¶•ªº–≠¸˛Ç◊ı˜Â¯˘¿ÅÍÎÏ˝ÓÔÒÚÆ☃Œ„´‰ˇÁ¨ˆØ∏”’`⁄€‹›fifl‡°·‚—±_¦ \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/e950f163b2268419 b/.hypothesis/examples/ecc7e8764d8d8b88/e950f163b2268419 new file mode 100644 index 0000000..0ec9933 --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/e950f163b2268419 @@ -0,0 +1 @@ +\00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/examples/ecc7e8764d8d8b88/f1dcb3c663df9e30 b/.hypothesis/examples/ecc7e8764d8d8b88/f1dcb3c663df9e30 new file mode 100644 index 0000000..49fa9aa --- /dev/null +++ b/.hypothesis/examples/ecc7e8764d8d8b88/f1dcb3c663df9e30 @@ -0,0 +1 @@ +O0000000000000000000000000000000000000000000000000000000000000000000000000000000 \ No newline at end of file diff --git a/.hypothesis/unicode_data/16.0.0/codec-utf-8.json.gz b/.hypothesis/unicode_data/16.0.0/codec-utf-8.json.gz index 3e73967..680ce70 100644 Binary files a/.hypothesis/unicode_data/16.0.0/codec-utf-8.json.gz and b/.hypothesis/unicode_data/16.0.0/codec-utf-8.json.gz differ diff --git a/decnet/web/api.py b/decnet/web/api.py index 323cd5e..e6a7288 100644 --- a/decnet/web/api.py +++ b/decnet/web/api.py @@ -108,12 +108,12 @@ class Token(BaseModel): class LoginRequest(BaseModel): username: str - password: str + password: str = Field(..., max_length=72) class ChangePasswordRequest(BaseModel): - old_password: str - new_password: str + old_password: str = Field(..., max_length=72) + new_password: str = Field(..., max_length=72) class LogsResponse(BaseModel): diff --git a/decnet/web/auth.py b/decnet/web/auth.py index 9d987c9..546ba0b 100644 --- a/decnet/web/auth.py +++ b/decnet/web/auth.py @@ -12,7 +12,7 @@ ACCESS_TOKEN_EXPIRE_MINUTES: int = 1440 def verify_password(plain_password: str, hashed_password: str) -> bool: return bcrypt.checkpw( - plain_password.encode("utf-8"), + plain_password.encode("utf-8")[:72], hashed_password.encode("utf-8") ) @@ -20,7 +20,7 @@ def verify_password(plain_password: str, hashed_password: str) -> bool: def get_password_hash(password: str) -> str: # Use a cost factor of 12 (default for passlib/bcrypt) _salt: bytes = bcrypt.gensalt(rounds=12) - _hashed: bytes = bcrypt.hashpw(password.encode("utf-8"), _salt) + _hashed: bytes = bcrypt.hashpw(password.encode("utf-8")[:72], _salt) return _hashed.decode("utf-8") diff --git a/tests/.test_web_api_fuzz.py.swp b/tests/.test_web_api_fuzz.py.swp new file mode 100644 index 0000000..b326594 Binary files /dev/null and b/tests/.test_web_api_fuzz.py.swp differ