kamp/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2024-07-02 15:20:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

Change pwd check to O(1) check to prevent timing attacks - single user mode (#575)

Browse Source 
Change pwd check to O(1) check to prevent timing attacks
This commit is contained in:
Timothy Carambat 2024-01-11 10:54:55 -08:00 committed by GitHub
parent a4ace56a40
commit 3c859ba303
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
frontend/src/components/Modals/Password/index.jsx
View File

@ -37,7 +37,7 @@ export default function PasswordModal({ mode = "single" }) {
export function usePasswordModal() {
const [auth, setAuth] = useState({
loading: true,
required: false,
requiresAuth: false,
mode: "single",
});

6
frontend/src/pages/Login/index.jsx
View File

@ -1,9 +1,13 @@
import React from "react";
import PasswordModal, { usePasswordModal } from "@/components/Modals/Password";
import { FullScreenLoader } from "@/components/Preloader";
import { Navigate } from "react-router-dom";
import paths from "@/utils/paths";
export default function Login() {
const { loading, mode } = usePasswordModal();
const { loading, requiresAuth, mode } = usePasswordModal();
if (loading) return <FullScreenLoader />;
if (requiresAuth === false) return <Navigate to={paths.home()} />;
return <PasswordModal mode={mode} />;
}

10
server/endpoints/system.js
View File

@ -107,6 +107,8 @@ function systemEndpoints(app) {
app.post("/request-token", async (request, response) => {
try {
const bcrypt = require("bcrypt");
if (await SystemSettings.isMultiUserMode()) {
const { username, password } = reqBody(request);
const existingUser = await User.get({ username });
@ -121,7 +123,6 @@ function systemEndpoints(app) {
return;
}
const bcrypt = require("bcrypt");
if (!bcrypt.compareSync(password, existingUser.password)) {
response.status(200).json({
user: null,
@ -159,7 +160,12 @@ function systemEndpoints(app) {
return;
} else {
const { password } = reqBody(request);
if (password !== process.env.AUTH_TOKEN) {
if (
!bcrypt.compareSync(
password,
bcrypt.hashSync(process.env.AUTH_TOKEN, 10)
)
) {
response.status(401).json({
valid: false,
token: null,

3
server/utils/middleware/validatedRequest.js
View File

@ -36,8 +36,9 @@ async function validatedRequest(request, response, next) {
return;
}
const bcrypt = require("bcrypt");
const { p } = decodeJWT(token);
if (p !== process.env.AUTH_TOKEN) {
if (!bcrypt.compareSync(p, bcrypt.hashSync(process.env.AUTH_TOKEN, 10))) {
response.status(401).json({
error: "Invalid auth token found.",
});