poanetwork
/
gecko
mirror of https://github.com/poanetwork/gecko.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix for KeyStore DoS vulnerability 

https://github.com/ava-labs/gecko/issues/195
This commit is contained in:
Shashank 2020-06-02 22:47:02 +05:30 committed by GitHub
parent 7671cab972
commit 8e8dd7529b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
api/keystore/service.go
View File

@ -148,9 +148,17 @@ func (ks *Keystore) CreateUser(_ *http.Request, args *CreateUserArgs, reply *Cre
return fmt.Errorf("user already exists: %s", args.Username)
}
if zxcvbn.PasswordStrength(args.Password, nil).Score < requiredPassScore {
return errWeakPassword
}
if len(args.Password) < 50 {
if zxcvbn.PasswordStrength(args.Password, nil).Score < requiredPassScore {
return errWeakPassword
}
}
if len(args.Password) >= 50 {
if zxcvbn.PasswordStrength(args.Password[:50], nil).Score < requiredPassScore {
return errWeakPassword
}
}
usr := &User{}
if err := usr.Initialize(args.Password); err != nil {