Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use CryptoRandomBytes instead of CryptoRandomString #18439

Merged
merged 16 commits into from
Feb 4, 2022
5 changes: 4 additions & 1 deletion models/auth/oauth2.go
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ package auth
import (
"crypto/sha256"
"encoding/base64"
"encoding/hex"
"fmt"
"net/url"
"strings"
Expand Down Expand Up @@ -59,10 +60,12 @@ func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool {

// GenerateClientSecret will generate the client secret and returns the plaintext and saves the hash at the database
func (app *OAuth2Application) GenerateClientSecret() (string, error) {
clientSecret, err := secret.New()
rBytes, err := util.CryptoRandomBytes(44)
Gusted marked this conversation as resolved.
Show resolved Hide resolved
if err != nil {
return "", err
}
clientSecret := hex.EncodeToString(rBytes)

hashedSecret, err := bcrypt.GenerateFromPassword([]byte(clientSecret), bcrypt.DefaultCost)
if err != nil {
return "", err
Expand Down
12 changes: 0 additions & 12 deletions modules/secret/secret.go
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,8 @@ import (
"encoding/hex"
"errors"
"io"

"code.gitea.io/gitea/modules/util"
)

// New creates a new secret
func New() (string, error) {
return NewWithLength(44)
}

// NewWithLength creates a new secret for a given length
func NewWithLength(length int64) (string, error) {
return util.CryptoRandomString(length)
}

// AesEncrypt encrypts text and given key with AES.
func AesEncrypt(key, text []byte) ([]byte, error) {
block, err := aes.NewCipher(key)
Expand Down
11 changes: 0 additions & 11 deletions modules/secret/secret_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,6 @@ import (
"github.com/stretchr/testify/assert"
)

func TestNew(t *testing.T) {
result, err := New()
assert.NoError(t, err)
assert.True(t, len(result) == 44)

result2, err := New()
assert.NoError(t, err)
// check if secrets
assert.NotEqual(t, result, result2)
}

func TestEncryptDecrypt(t *testing.T) {
var hex string
var str string
Expand Down