github-wownero/wownero
1
0
Fork 0
mirror of https://github.com/wownero/wownero.git synced 2026-10-17 07:31:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

Harden HTTP client auth

Browse Source 
(cherry picked from commit f355f85e6f7bea4a4f68c7880b2b995a3c225882)
This commit is contained in:
Lee *!* Clagett
2026-05-05 18:19:53 -04:00
committed by jwinterm
parent e1b8e51ea7
commit 93381db29c
2 changed files with 13 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit_tests/http.cpp
+2 -35
View File
@@ -614,10 +614,8 @@ TEST(HTTP_Client_Auth, BadSyntax)
TEST(HTTP_Client_Auth, MD5)
{
constexpr char method[] = "NOP";
constexpr char nonce[] = "some crazy nonce";
constexpr char realm[] = "the only realm";
constexpr char uri[] = "/some_file";
const http::login user{"foo", "bar"};
http::http_client_auth auth{user};
@@ -636,42 +634,11 @@ TEST(HTTP_Client_Auth, MD5)
},
});
EXPECT_EQ(http::http_client_auth::kSuccess, auth.handle_401(response));
const auto auth_field = auth.get_auth_field(method, uri);
ASSERT_TRUE(bool(auth_field));
const auto parsed = parse_fields(auth_field->second);
EXPECT_STREQ(u8"Authorization", auth_field->first.c_str());
EXPECT_EQ(parsed.end(), parsed.find(u8"opaque"));
EXPECT_EQ(parsed.end(), parsed.find(u8"qop"));
EXPECT_EQ(parsed.end(), parsed.find(u8"nc"));
EXPECT_STREQ(u8"MD5", parsed.at(u8"algorithm").c_str());
EXPECT_STREQ(nonce, parsed.at(u8"nonce").c_str());
EXPECT_STREQ(uri, parsed.at(u8"uri").c_str());
EXPECT_EQ(user.username, parsed.at(u8"username"));
EXPECT_STREQ(realm, parsed.at(u8"realm").c_str());
const std::string a1 = get_a1(user, parsed);
const std::string a2 = get_a2(uri);
const std::string auth_code = md5_hex(
boost::join(std::vector<std::string>{md5_hex(a1), nonce, md5_hex(a2)}, u8":")
);
EXPECT_TRUE(boost::iequals(auth_code, parsed.at(u8"response")));
{
const auto auth_field_dup = auth.get_auth_field(method, uri);
ASSERT_TRUE(bool(auth_field_dup));
EXPECT_EQ(*auth_field, *auth_field_dup);
}
EXPECT_EQ(http::http_client_auth::kBadPassword, auth.handle_401(response));
response.m_header_info.m_etc_fields.front().second.append(u8"," + write_fields({{u8"stale", u8"TRUE"}}));
EXPECT_EQ(http::http_client_auth::kSuccess, auth.handle_401(response));
EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(response));
}
TEST(HTTP_Client_Auth, MD5_auth)
{
constexpr char cnonce[] = "";
constexpr char method[] = "NOP";
constexpr char nonce[] = "some crazy nonce";
constexpr char opaque[] = "this is the opaque";
@@ -723,7 +690,7 @@ TEST(HTTP_Client_Auth, MD5_auth)
const std::string a1 = get_a1(user, parsed);
const std::string a2 = get_a2(uri);
const std::string auth_code = md5_hex(
boost::join(std::vector<std::string>{md5_hex(a1), nonce, nc, cnonce, u8"auth", md5_hex(a2)}, u8":")
boost::join(std::vector<std::string>{md5_hex(a1), nonce, nc, parsed.at(u8"cnonce"), u8"auth", md5_hex(a2)}, u8":")
);
EXPECT_TRUE(boost::iequals(auth_code, parsed.at(u8"response")));
}