magmaus3/continuwuity
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

guard against using someone else's access token in UIAA

Browse source
This commit is contained in:
cy 2025-03-12 20:46:14 -04:00 • committed by June Clementine Strawberry 🍓🦴
parent ee3c585555
commit 4518f55408
2 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/service/uiaa/mod.rs
View file

@ -4,7 +4,7 @@ use std::{
}; };
use conduwuit::{ use conduwuit::{
Error, Result, err, error, implement, utils, Err, Error, Result, err, error, implement, utils,
utils::{hash, string::EMPTY}, utils::{hash, string::EMPTY},
}; };
use database::{Deserialized, Json, Map}; use database::{Deserialized, Json, Map};
@ -150,12 +150,18 @@ pub async fn try_auth(
)); ));
}; };
let user_id = UserId::parse_with_server_name( let user_id_from_username = UserId::parse_with_server_name(
username.clone(), username.clone(),
self.services.globals.server_name(), self.services.globals.server_name(),
) )
.map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "User ID is invalid."))?; .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "User ID is invalid."))?;
// Check if the access token being used matches the credentials used for UIAA
if user_id.localpart() != user_id_from_username.localpart() {
return Err!(Request(Forbidden("User ID and access token mismatch.")));
}
let user_id = user_id_from_username;
// Check if password is correct // Check if password is correct
if let Ok(hash) = self.services.users.password_hash(&user_id).await { if let Ok(hash) = self.services.users.password_hash(&user_id).await {
let hash_matches = hash::verify_password(password, &hash).is_ok(); let hash_matches = hash::verify_password(password, &hash).is_ok();

2
tests/test_results/complement/test_results.jsonl
View file

@ -127,7 +127,7 @@
{"Action":"fail","Test":"TestDeviceListsUpdateOverFederationOnRoomJoin"} {"Action":"fail","Test":"TestDeviceListsUpdateOverFederationOnRoomJoin"}
{"Action":"fail","Test":"TestDeviceManagement"} {"Action":"fail","Test":"TestDeviceManagement"}
{"Action":"fail","Test":"TestDeviceManagement/DELETE_/device/{deviceId}"} {"Action":"fail","Test":"TestDeviceManagement/DELETE_/device/{deviceId}"}
{"Action":"fail","Test":"TestDeviceManagement/DELETE_/device/{deviceId}_requires_UI_auth_user_to_match_device_owner"} {"Action":"pass","Test":"TestDeviceManagement/DELETE_/device/{deviceId}_requires_UI_auth_user_to_match_device_owner"}
{"Action":"pass","Test":"TestDeviceManagement/GET_/device/{deviceId}"} {"Action":"pass","Test":"TestDeviceManagement/GET_/device/{deviceId}"}
{"Action":"pass","Test":"TestDeviceManagement/GET_/device/{deviceId}_gives_a_404_for_unknown_devices"} {"Action":"pass","Test":"TestDeviceManagement/GET_/device/{deviceId}_gives_a_404_for_unknown_devices"}
{"Action":"pass","Test":"TestDeviceManagement/GET_/devices"} {"Action":"pass","Test":"TestDeviceManagement/GET_/devices"}