mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-11-03 08:04:27 -05:00
InverleandAlexandre Alapetite
76e8993579
* Replace bcrypt challenge auth with direct password comparison Closes #2428 Highlights: * Replaced the bcrypt challenge authentication flow with direct password comparison against the bcrypt hash stored in the user configuration. * Removed the `bcrypt.js` dependency, so authentication no longer depends on JavaScript. * Removed the nonce and challenge mechanism and the `nonce` endpoint from the `javascript` controller. * Removed the JavaScript and HTML code used for the previous authentication flow. * Removed the `<noscript>` blocks that were only needed for the previous authentication flow. * Updated `FreshRSS_FormAuth::checkCredentials()` to accept the username, stored bcrypt hash, and plain-text password directly. * The stored password hash must still use the expected bcrypt format. * Empty or whitespace-only passwords are rejected even if the hash would otherwise match. * The bcrypt 72-byte limit is enforced during normal authentication. * Existing bcrypt passwords are handled correctly when the 72-byte limit cuts through a UTF-8 character. * Password input is no longer trimmed before authentication or password changes. Leading and trailing whitespace is therefore kept as part of the password. * Added `FreshRSS_FormAuth::passwordRequirementsMet()` to replace `FreshRSS_password_Util::check()`. * New passwords must be between 7 and 72 bytes by default. * The minimum length check can be disabled where needed. * Password requirements are now checked server-side for all password creation and update paths. * Added client-side byte-length validation for password fields using `TextEncoder` and `data-max-bytes`. * This gives better feedback for UTF-8 passwords. * Server-side validation remains authoritative. * Updated password handling in authentication, re-authentication, self-deletion, user creation, and user update paths so passwords are not trimmed automatically. * Added `FormAuthTest` to cover: * password length limits in bytes * UTF-8 passwords around the 72-byte limit * bcrypt truncation behavior during authentication * malformed and non-bcrypt hashes * empty passwords * authentication failures and log messages * Removed `bcrypt.js` from the documented dependencies and updated the authentication documentation. * Updated the installation and authentication views and JavaScript to match the new password handling. This simplifies the authentication flow, removes the client-side bcrypt challenge, makes password validation consistent between the client and server, and adds more test coverage while keeping compatibility with existing bcrypt password hashes. Because the password is now sent directly to the server instead of being processed by `bcrypt.js`, deployments should use HTTPS. Documentation for HTTPS setup can be handled separately. * Add test case with password truncated down to 71 characters * Compare log messages too during form auth tests * Mark the `getLastLog()` method as impure * Fix: Check password reqs against new password instead of current * Fix: Add custom JS validator for UTF-8, handle cut-off UTF-8 during login * Fix: Enforce password requirements everywhere server-side * Add TODO for updateUser in CLI * make readme * Fix extra.js in install.php * Don't report validity yet if the password is too short or not filled out * Simplify checking of whether to report validity * Fix: Do not trim password from user's input * Also `trim: false` in some userController paths * Use the proper argument order for PHPUnit's `assertSame()` * Remove `maxlength` in favor of `data-max-bytes` But add `pattern` again for some nojs support * make readme * composer run-script translations * Update i18n string for web form admin setting * i18n: fr * Minor whitespace --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
340 lines
12 KiB
PHP
340 lines
12 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
final class FormAuthTest extends \PHPUnit\Framework\TestCase {
|
|
public function testCheck(): void {
|
|
$password = '1234567';
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertTrue($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsFalseIfEmpty(): void {
|
|
$password = '';
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertFalse($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsFalseIfLessThan7Characters(): void {
|
|
$password = '123456';
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertFalse($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsFalseIfLessThan7Utf8Bytes(): void {
|
|
$password = str_repeat('é', 3);
|
|
self::assertSame(6, strlen($password));
|
|
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertFalse($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsTrueIfAtExactly72Characters(): void {
|
|
$password = str_repeat('A', 72);
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertTrue($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsFalseIfMoreThan72Characters(): void {
|
|
$password = str_repeat('A', 73);
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertFalse($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsTrueIfAtExactly72Utf8Bytes(): void {
|
|
$password = str_repeat('é', 36);
|
|
self::assertSame(72, strlen($password));
|
|
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertTrue($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsFalseIfMoreThan72Utf8Bytes(): void {
|
|
$password = str_repeat('é', 37);
|
|
self::assertSame(74, strlen($password));
|
|
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertFalse($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsFalseIfAtExactly73Utf8Bytes(): void {
|
|
$password = str_repeat('é', 36) . 'a';
|
|
self::assertSame(73, strlen($password));
|
|
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password);
|
|
self::assertFalse($ok);
|
|
}
|
|
|
|
public function testReqsCheckAcceptsOtherMultibyteBoundary(): void {
|
|
$password = str_repeat('€', 24);
|
|
self::assertSame(72, strlen($password));
|
|
self::assertTrue(FreshRSS_FormAuth::passwordRequirementsMet($password));
|
|
|
|
$password .= '€';
|
|
self::assertSame(75, strlen($password));
|
|
self::assertFalse(FreshRSS_FormAuth::passwordRequirementsMet($password));
|
|
}
|
|
|
|
public function testReqsCheckReturnsTrueIfLessThan7CharactersAndWithNoMinLengthEnforcement(): void {
|
|
$password = '123456';
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password, ['enforceMinLength' => false]);
|
|
self::assertTrue($ok);
|
|
}
|
|
|
|
public function testReqsCheckReturnsTrueIfLessThan7Utf8BytesAndWithNoMinLengthEnforcement(): void {
|
|
$password = str_repeat('é', 3);
|
|
self::assertSame(6, strlen($password));
|
|
|
|
$ok = FreshRSS_FormAuth::passwordRequirementsMet($password, ['enforceMinLength' => false]);
|
|
self::assertTrue($ok);
|
|
}
|
|
|
|
public function testAuthWithInvalidUsernameAndCorrectCredentialsFail(): void {
|
|
$username = ':-)';
|
|
$password = '1234567';
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Invalid credential parameters: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndWrongCredentialsFail(): void {
|
|
$username = 'admin';
|
|
$password = 'correctpassword';
|
|
$hash = FreshRSS_password_Util::hash('badpassword');
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsOk(): void {
|
|
$username = 'admin';
|
|
$password = 'correctpassword';
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertTrue($ok);
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongUtf8PasswordOk(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 71) . 'é';
|
|
self::assertSame(73, strlen($password));
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertTrue($ok); // Login is successful with a cut-off UTF-8 character at the end
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
|
|
$password .= 'é';
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Exceeded maximum allowed password length during authentication: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongUtf8PasswordWithCutOffCharacterFollowedByAnotherCharacterFail(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 71) . 'éa';
|
|
self::assertSame(74, strlen($password));
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Exceeded maximum allowed password length during authentication: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongUtf8PasswordWithThreeByteCharacterOk(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 71) . '€';
|
|
self::assertSame(74, strlen($password));
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertTrue($ok); // Login is successful with a cut-off UTF-8 character at the end
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
|
|
$password .= '€';
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Exceeded maximum allowed password length during authentication: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongUtf8PasswordWithFourByteCharacterOk(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 71) . '😀';
|
|
self::assertSame(75, strlen($password));
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertTrue($ok); // Login is successful with a cut-off UTF-8 character at the end
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
|
|
$password .= '😀';
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Exceeded maximum allowed password length during authentication: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongUtf8PasswordWithThreeByteCharacterCutOffAfterTwoBytesOk(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 70) . '€';
|
|
self::assertSame(73, strlen($password));
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertTrue($ok);
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongUtf8PasswordWithFourByteCharacterCutOffAfterTwoBytesOk(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 70) . '😀';
|
|
self::assertSame(74, strlen($password));
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertTrue($ok);
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongUtf8PasswordWithFourByteCharacterCutOffAfterThreeBytesOk(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 69) . '😀';
|
|
self::assertSame(73, strlen($password));
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertTrue($ok);
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongUtf8PasswordWithoutCutOffCharacter(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 72) . 'é';
|
|
self::assertSame(74, strlen($password));
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Exceeded maximum allowed password length during authentication: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndHugeUtf8Password(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 10000) . 'é';
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Exceeded maximum allowed password length during authentication: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndEmptyPasswordFail(): void {
|
|
$username = 'admin';
|
|
$password = '';
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Refusing authentication with empty zero-length password: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndTooLongPasswordFail(): void {
|
|
$username = 'admin';
|
|
$password = str_repeat('a', 73);
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Exceeded maximum allowed password length during authentication: user={$username}", Minz_Log::getLastLog());
|
|
|
|
// It's fine if the user truncates their own password though
|
|
// Note: There are separate tests for UTF-8 passwords to test the case
|
|
// of a cut-off UTF-8 character at the end, which can't easily be truncated
|
|
// by a user.
|
|
$password = str_repeat('a', 72);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertTrue($ok);
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
|
|
// If truncated down to less than 72 characters, login should fail
|
|
$password = str_repeat('a', 71);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectCredentialsAndWrongPassAlgorithmFail(): void {
|
|
$username = 'admin';
|
|
$password = '1234567';
|
|
$hash = crypt($password, 'ab'); // Uses `password_verify()` compatible algorithm
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Invalid hash format: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndAnyCredentialsAndMalformedBcryptHashFail(): void {
|
|
$username = 'admin';
|
|
$password = 'whatever';
|
|
$hash = '$2y$04$00000000$'; // See: https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Invalid hash format: user={$username}", Minz_Log::getLastLog());
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndAnyCredentialsAndEmptyHashFail(): void {
|
|
$username = 'admin';
|
|
$password = 'whatever';
|
|
$hash = '';
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $password
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame("Invalid credential parameters: user={$username}", Minz_Log::getLastLog()); // `ctype_graph($hash)` returns false on empty string values
|
|
}
|
|
|
|
public function testAuthWithValidUsernameAndCorrectHashAsPasswordFail(): void {
|
|
$username = 'admin';
|
|
$password = 'whatever';
|
|
$hash = FreshRSS_password_Util::hash($password);
|
|
$ok = FreshRSS_FormAuth::checkCredentials(
|
|
$username, $hash, $hash
|
|
);
|
|
self::assertFalse($ok);
|
|
self::assertSame('', Minz_Log::getLastLog());
|
|
}
|
|
}
|