Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit aae5a96

Browse files
freakboy3742freakboy3742
committed
Ensure that passwords are never long enough for a DoS.
* Limit the password length to 4096 bytes * Password hashers will raise a ValueError * django.contrib.auth forms will fail validation * Document in release notes that this is a backwards incompatible change Thanks to Josh Wright for the report, and Donald Stufft for the patch. This is a security fix; disclosure to follow shortly.
1 parent 351a061 commit aae5a96

File tree

4 files changed

+153
-17
lines changed

4 files changed

+153
-17
lines changed

‎django/contrib/auth/forms.py‎

Lines changed: 35 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,9 @@
1414

1515
from django.contrib.auth import authenticate, get_user_model
1616
from django.contrib.auth.models import User
17-
from django.contrib.auth.hashers import UNUSABLE_PASSWORD_PREFIX, identify_hasher
17+
from django.contrib.auth.hashers import (
18+
MAXIMUM_PASSWORD_LENGTH, UNUSABLE_PASSWORD_PREFIX, identify_hasher,
19+
)
1820
from django.contrib.auth.tokens import default_token_generator
1921
from django.contrib.sites.models import get_current_site
2022

@@ -80,9 +82,10 @@ class UserCreationForm(forms.ModelForm):
8082
'invalid': _("This value may contain only letters, numbers and "
8183
"@/./+/-/_ characters.")})
8284
password1 = forms.CharField(label=_("Password"),
83-
widget=forms.PasswordInput)
85+
widget=forms.PasswordInput, max_length=MAXIMUM_PASSWORD_LENGTH)
8486
password2 = forms.CharField(label=_("Password confirmation"),
8587
widget=forms.PasswordInput,
88+
max_length=MAXIMUM_PASSWORD_LENGTH,
8689
help_text=_("Enter the same password as above, for verification."))
8790

8891
class Meta:
@@ -156,7 +159,11 @@ class AuthenticationForm(forms.Form):
156159
username/password logins.
157160
"""
158161
username = forms.CharField(max_length=254)
159-
password = forms.CharField(label=_("Password"), widget=forms.PasswordInput)
162+
password = forms.CharField(
163+
label=_("Password"),
164+
widget=forms.PasswordInput,
165+
max_length=MAXIMUM_PASSWORD_LENGTH,
166+
)
160167

161168
error_messages = {
162169
'invalid_login': _("Please enter a correct %(username)s and password. "
@@ -279,10 +286,16 @@ class SetPasswordForm(forms.Form):
279286
error_messages = {
280287
'password_mismatch': _("The two password fields didn't match."),
281288
}
282-
new_password1 = forms.CharField(label=_("New password"),
283-
widget=forms.PasswordInput)
284-
new_password2 = forms.CharField(label=_("New password confirmation"),
285-
widget=forms.PasswordInput)
289+
new_password1 = forms.CharField(
290+
label=_("New password"),
291+
widget=forms.PasswordInput,
292+
max_length=MAXIMUM_PASSWORD_LENGTH,
293+
)
294+
new_password2 = forms.CharField(
295+
label=_("New password confirmation"),
296+
widget=forms.PasswordInput,
297+
max_length=MAXIMUM_PASSWORD_LENGTH,
298+
)
286299

287300
def __init__(self, user, *args, **kwargs):
288301
self.user = user
@@ -315,8 +328,11 @@ class PasswordChangeForm(SetPasswordForm):
315328
'password_incorrect': _("Your old password was entered incorrectly. "
316329
"Please enter it again."),
317330
})
318-
old_password = forms.CharField(label=_("Old password"),
319-
widget=forms.PasswordInput)
331+
old_password = forms.CharField(
332+
label=_("Old password"),
333+
widget=forms.PasswordInput,
334+
max_length=MAXIMUM_PASSWORD_LENGTH,
335+
)
320336

321337
def clean_old_password(self):
322338
"""
@@ -343,10 +359,16 @@ class AdminPasswordChangeForm(forms.Form):
343359
error_messages = {
344360
'password_mismatch': _("The two password fields didn't match."),
345361
}
346-
password1 = forms.CharField(label=_("Password"),
347-
widget=forms.PasswordInput)
348-
password2 = forms.CharField(label=_("Password (again)"),
349-
widget=forms.PasswordInput)
362+
password1 = forms.CharField(
363+
label=_("Password"),
364+
widget=forms.PasswordInput,
365+
max_length=MAXIMUM_PASSWORD_LENGTH,
366+
)
367+
password2 = forms.CharField(
368+
label=_("Password (again)"),
369+
widget=forms.PasswordInput,
370+
max_length=MAXIMUM_PASSWORD_LENGTH,
371+
)
350372

351373
def __init__(self, user, *args, **kwargs):
352374
self.user = user

‎django/contrib/auth/hashers.py‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import base64
44
import binascii
55
from collections import OrderedDict
6+
import functools
67
import hashlib
78
import importlib
89

@@ -19,6 +20,7 @@
1920

2021
UNUSABLE_PASSWORD_PREFIX = '!' # This will never be a valid encoded hash
2122
UNUSABLE_PASSWORD_SUFFIX_LENGTH = 40 # number of random chars to add after UNUSABLE_PASSWORD_PREFIX
23+
MAXIMUM_PASSWORD_LENGTH = 4096 # The maximum length a password can be to prevent DoS
2224
HASHERS = None # lazily loaded from PASSWORD_HASHERS
2325
PREFERRED_HASHER = None # defaults to first item in PASSWORD_HASHERS
2426

@@ -31,6 +33,18 @@ def reset_hashers(**kwargs):
3133
PREFERRED_HASHER = None
3234

3335

36+
def password_max_length(max_length):
37+
def inner(fn):
38+
@functools.wraps(fn)
39+
def wrapper(self, password, *args, **kwargs):
40+
if len(password) > max_length:
41+
raise ValueError("Invalid password; Must be less than or equal"
42+
" to %d bytes" % max_length)
43+
return fn(self, password, *args, **kwargs)
44+
return wrapper
45+
return inner
46+
47+
3448
def is_password_usable(encoded):
3549
if encoded is None or encoded.startswith(UNUSABLE_PASSWORD_PREFIX):
3650
return False
@@ -225,6 +239,7 @@ class PBKDF2PasswordHasher(BasePasswordHasher):
225239
iterations = 10000
226240
digest = hashlib.sha256
227241

242+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
228243
def encode(self, password, salt, iterations=None):
229244
assert password is not None
230245
assert salt and '$' not in salt
@@ -234,6 +249,7 @@ def encode(self, password, salt, iterations=None):
234249
hash = base64.b64encode(hash).decode('ascii').strip()
235250
return "%s$%d$%s$%s" % (self.algorithm, iterations, salt, hash)
236251

252+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
237253
def verify(self, password, encoded):
238254
algorithm, iterations, salt, hash = encoded.split('$', 3)
239255
assert algorithm == self.algorithm
@@ -280,6 +296,7 @@ def salt(self):
280296
bcrypt = self._load_library()
281297
return bcrypt.gensalt(self.rounds)
282298

299+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
283300
def encode(self, password, salt):
284301
bcrypt = self._load_library()
285302
# Need to reevaluate the force_bytes call once bcrypt is supported on
@@ -297,6 +314,7 @@ def encode(self, password, salt):
297314
data = bcrypt.hashpw(password, salt)
298315
return "%s$%s" % (self.algorithm, force_text(data))
299316

317+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
300318
def verify(self, password, encoded):
301319
algorithm, data = encoded.split('$', 1)
302320
assert algorithm == self.algorithm
@@ -353,12 +371,14 @@ class SHA1PasswordHasher(BasePasswordHasher):
353371
"""
354372
algorithm = "sha1"
355373

374+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
356375
def encode(self, password, salt):
357376
assert password is not None
358377
assert salt and '$' not in salt
359378
hash = hashlib.sha1(force_bytes(salt + password)).hexdigest()
360379
return "%s$%s$%s" % (self.algorithm, salt, hash)
361380

381+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
362382
def verify(self, password, encoded):
363383
algorithm, salt, hash = encoded.split('$', 2)
364384
assert algorithm == self.algorithm
@@ -381,12 +401,14 @@ class MD5PasswordHasher(BasePasswordHasher):
381401
"""
382402
algorithm = "md5"
383403

404+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
384405
def encode(self, password, salt):
385406
assert password is not None
386407
assert salt and '$' not in salt
387408
hash = hashlib.md5(force_bytes(salt + password)).hexdigest()
388409
return "%s$%s$%s" % (self.algorithm, salt, hash)
389410

411+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
390412
def verify(self, password, encoded):
391413
algorithm, salt, hash = encoded.split('$', 2)
392414
assert algorithm == self.algorithm
@@ -417,11 +439,13 @@ class UnsaltedSHA1PasswordHasher(BasePasswordHasher):
417439
def salt(self):
418440
return ''
419441

442+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
420443
def encode(self, password, salt):
421444
assert salt == ''
422445
hash = hashlib.sha1(force_bytes(password)).hexdigest()
423446
return 'sha1$$%s' % hash
424447

448+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
425449
def verify(self, password, encoded):
426450
encoded_2 = self.encode(password, '')
427451
return constant_time_compare(encoded, encoded_2)
@@ -451,10 +475,12 @@ class UnsaltedMD5PasswordHasher(BasePasswordHasher):
451475
def salt(self):
452476
return ''
453477

478+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
454479
def encode(self, password, salt):
455480
assert salt == ''
456481
return hashlib.md5(force_bytes(password)).hexdigest()
457482

483+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
458484
def verify(self, password, encoded):
459485
if len(encoded) == 37 and encoded.startswith('md5$$'):
460486
encoded = encoded[5:]
@@ -480,13 +506,15 @@ class CryptPasswordHasher(BasePasswordHasher):
480506
def salt(self):
481507
return get_random_string(2)
482508

509+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
483510
def encode(self, password, salt):
484511
crypt = self._load_library()
485512
assert len(salt) == 2
486513
data = crypt.crypt(force_str(password), salt)
487514
# we don't need to store the salt, but Django used to do this
488515
return "%s$%s$%s" % (self.algorithm, '', data)
489516

517+
@password_max_length(MAXIMUM_PASSWORD_LENGTH)
490518
def verify(self, password, encoded):
491519
crypt = self._load_library()
492520
algorithm, salt, data = encoded.split('$', 2)
@@ -501,4 +529,3 @@ def safe_summary(self, encoded):
501529
(_('salt'), salt),
502530
(_('hash'), mask_hash(data, show=3)),
503531
])
504-

‎django/contrib/auth/tests/test_hashers.py‎

Lines changed: 82 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,12 @@
55
from unittest import skipUnless
66

77
from django.conf.global_settings import PASSWORD_HASHERS as default_hashers
8-
from django.contrib.auth.hashers import (is_password_usable, BasePasswordHasher,
9-
check_password, make_password, PBKDF2PasswordHasher, load_hashers, PBKDF2SHA1PasswordHasher,
10-
get_hasher, identify_hasher, UNUSABLE_PASSWORD_PREFIX, UNUSABLE_PASSWORD_SUFFIX_LENGTH)
8+
from django.contrib.auth.hashers import (
9+
is_password_usable, BasePasswordHasher, check_password, make_password,
10+
PBKDF2PasswordHasher, load_hashers, PBKDF2SHA1PasswordHasher, get_hasher,
11+
identify_hasher, UNUSABLE_PASSWORD_PREFIX, UNUSABLE_PASSWORD_SUFFIX_LENGTH,
12+
MAXIMUM_PASSWORD_LENGTH, password_max_length
13+
)
1114
from django.utils import six
1215

1316

@@ -39,6 +42,12 @@ def test_simple(self):
3942
self.assertTrue(is_password_usable(blank_encoded))
4043
self.assertTrue(check_password('', blank_encoded))
4144
self.assertFalse(check_password(' ', blank_encoded))
45+
# Long password
46+
self.assertRaises(
47+
ValueError,
48+
make_password,
49+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
50+
)
4251

4352
def test_pkbdf2(self):
4453
encoded = make_password('lètmein', 'seasalt', 'pbkdf2_sha256')
@@ -54,6 +63,14 @@ def test_pkbdf2(self):
5463
self.assertTrue(is_password_usable(blank_encoded))
5564
self.assertTrue(check_password('', blank_encoded))
5665
self.assertFalse(check_password(' ', blank_encoded))
66+
# Long password
67+
self.assertRaises(
68+
ValueError,
69+
make_password,
70+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
71+
"seasalt",
72+
"pbkdf2_sha256",
73+
)
5774

5875
def test_sha1(self):
5976
encoded = make_password('lètmein', 'seasalt', 'sha1')
@@ -69,6 +86,14 @@ def test_sha1(self):
6986
self.assertTrue(is_password_usable(blank_encoded))
7087
self.assertTrue(check_password('', blank_encoded))
7188
self.assertFalse(check_password(' ', blank_encoded))
89+
# Long password
90+
self.assertRaises(
91+
ValueError,
92+
make_password,
93+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
94+
"seasalt",
95+
"sha1",
96+
)
7297

7398
def test_md5(self):
7499
encoded = make_password('lètmein', 'seasalt', 'md5')
@@ -84,6 +109,14 @@ def test_md5(self):
84109
self.assertTrue(is_password_usable(blank_encoded))
85110
self.assertTrue(check_password('', blank_encoded))
86111
self.assertFalse(check_password(' ', blank_encoded))
112+
# Long password
113+
self.assertRaises(
114+
ValueError,
115+
make_password,
116+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
117+
"seasalt",
118+
"md5",
119+
)
87120

88121
def test_unsalted_md5(self):
89122
encoded = make_password('lètmein', '', 'unsalted_md5')
@@ -102,6 +135,14 @@ def test_unsalted_md5(self):
102135
self.assertTrue(is_password_usable(blank_encoded))
103136
self.assertTrue(check_password('', blank_encoded))
104137
self.assertFalse(check_password(' ', blank_encoded))
138+
# Long password
139+
self.assertRaises(
140+
ValueError,
141+
make_password,
142+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
143+
"",
144+
"unsalted_md5",
145+
)
105146

106147
def test_unsalted_sha1(self):
107148
encoded = make_password('lètmein', '', 'unsalted_sha1')
@@ -119,6 +160,14 @@ def test_unsalted_sha1(self):
119160
self.assertTrue(is_password_usable(blank_encoded))
120161
self.assertTrue(check_password('', blank_encoded))
121162
self.assertFalse(check_password(' ', blank_encoded))
163+
# Long password
164+
self.assertRaises(
165+
ValueError,
166+
make_password,
167+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
168+
"",
169+
"unslated_sha1",
170+
)
122171

123172
@skipUnless(crypt, "no crypt module to generate password.")
124173
def test_crypt(self):
@@ -134,6 +183,14 @@ def test_crypt(self):
134183
self.assertTrue(is_password_usable(blank_encoded))
135184
self.assertTrue(check_password('', blank_encoded))
136185
self.assertFalse(check_password(' ', blank_encoded))
186+
# Long password
187+
self.assertRaises(
188+
ValueError,
189+
make_password,
190+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
191+
"seasalt",
192+
"crypt",
193+
)
137194

138195
@skipUnless(bcrypt, "bcrypt not installed")
139196
def test_bcrypt_sha256(self):
@@ -156,6 +213,13 @@ def test_bcrypt_sha256(self):
156213
self.assertTrue(is_password_usable(blank_encoded))
157214
self.assertTrue(check_password('', blank_encoded))
158215
self.assertFalse(check_password(' ', blank_encoded))
216+
# Long password
217+
self.assertRaises(
218+
ValueError,
219+
make_password,
220+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
221+
hasher="bcrypt_sha256",
222+
)
159223

160224
@skipUnless(bcrypt, "bcrypt not installed")
161225
def test_bcrypt(self):
@@ -171,6 +235,13 @@ def test_bcrypt(self):
171235
self.assertTrue(is_password_usable(blank_encoded))
172236
self.assertTrue(check_password('', blank_encoded))
173237
self.assertFalse(check_password(' ', blank_encoded))
238+
# Long password
239+
self.assertRaises(
240+
ValueError,
241+
make_password,
242+
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
243+
hasher="bcrypt",
244+
)
174245

175246
def test_unusable(self):
176247
encoded = make_password(None)
@@ -203,6 +274,14 @@ def test_bad_encoded(self):
203274
self.assertFalse(is_password_usable('lètmein_badencoded'))
204275
self.assertFalse(is_password_usable(''))
205276

277+
def test_max_password_length_decorator(self):
278+
@password_max_length(10)
279+
def encode(s, password, salt):
280+
return True
281+
282+
self.assertTrue(encode(None, b"1234", b"1234"))
283+
self.assertRaises(ValueError, encode, None, b"1234567890A", b"1234")
284+
206285
def test_low_level_pkbdf2(self):
207286
hasher = PBKDF2PasswordHasher()
208287
encoded = hasher.encode('lètmein', 'seasalt')

0 commit comments

Comments
 (0)