mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-09-21 09:05:10 -07:00
Some checks are pending
CodeQL / Analyze (cpp) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
Build Desktop / Configure (push) Waiting to run
Build Desktop / Debian 13 (push) Blocked by required conditions
Build Desktop / Debian 12 (push) Blocked by required conditions
Build Desktop / Fedora 44 (push) Blocked by required conditions
Build Desktop / Fedora 43 (push) Blocked by required conditions
Build Desktop / Servatrice_Debian 12 (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 (push) Blocked by required conditions
Build Desktop / Ubuntu 24.04 (push) Blocked by required conditions
Build Desktop / Arch (push) Blocked by required conditions
Build Desktop / macOS 13 Intel (push) Blocked by required conditions
Build Desktop / macOS 14 (push) Blocked by required conditions
Build Desktop / macOS 15 (push) Blocked by required conditions
Build Desktop / macOS 26 Debug (push) Blocked by required conditions
Build Desktop / Windows 10 (push) Blocked by required conditions
Build Docker / Servatrice (arm) (push) Waiting to run
Build Docker / Servatrice (x86) (push) Waiting to run
Build Docker / Publish multi-platform Servatrice image (push) Blocked by required conditions
* [Security] Use a CSPRNG for salts, tokens, and RNG seeding Password salts and activation tokens were generated with the global SFMT RNG, which was seeded from a 32-bit timestamp, making registration salts and activation tokens predictable. The game RNG used the same timestamp seed across restarts. Add CryptoUtil backed by OpenSSL RAND_bytes and use it for salt/token generation and to seed RNG_SFMT with a 64-bit CSPRNG value in both the client and server. Link libcockatrice_utility against OpenSSL::Crypto. Took 30 seconds Took 25 minutes * Lint. Took 4 minutes Took 36 seconds --------- Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
45 lines
1.3 KiB
C++
45 lines
1.3 KiB
C++
#include "gtest/gtest.h"
|
|
#include <cstring>
|
|
#include <libcockatrice/utility/passwordhasher.h>
|
|
|
|
namespace
|
|
{
|
|
|
|
TEST(PasswordHashTest, RegressionTest)
|
|
{
|
|
QString salt = "saltsaltsaltsalt";
|
|
QString password = "password";
|
|
QString expected = "vmKoWv975yf+WT2QCXhW48JNzZ2ghGxdgNvuKLBU0h7s6AQHSG72J6QO4ZswuSeqvBbAXbmgJSRBaSJrgc55WA==";
|
|
QString hash = PasswordHasher::computeHash(password, salt);
|
|
ASSERT_EQ(hash, salt + expected) << "The computed hash value remains the same";
|
|
}
|
|
|
|
TEST(PasswordHashTest, SaltUsesAlphanumericCharset)
|
|
{
|
|
static const char alphanum[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
|
|
const QString salt = PasswordHasher::generateRandomSalt();
|
|
ASSERT_EQ(salt.size(), 16);
|
|
for (const QChar &c : salt) {
|
|
ASSERT_NE(strchr(alphanum, c.toLatin1()), nullptr);
|
|
}
|
|
}
|
|
|
|
TEST(PasswordHashTest, SaltsAreUnique)
|
|
{
|
|
const QString salt1 = PasswordHasher::generateRandomSalt();
|
|
const QString salt2 = PasswordHasher::generateRandomSalt();
|
|
ASSERT_NE(salt1, salt2);
|
|
}
|
|
|
|
TEST(PasswordHashTest, TokenHasExpectedLength)
|
|
{
|
|
const QString token = PasswordHasher::generateActivationToken();
|
|
ASSERT_EQ(token.size(), 16);
|
|
}
|
|
} // namespace
|
|
|
|
int main(int argc, char **argv)
|
|
{
|
|
::testing::InitGoogleTest(&argc, argv);
|
|
return RUN_ALL_TESTS();
|
|
}
|