| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
| |
join_byte_values() wrappers
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
"native_string_types" aliases
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |\ |
|
| | |
| |
| |
| |
| |
| | |
isn't available.
(needed for windows)
|
| | | |
|
| | |
| |
| |
| |
| | |
before boolean; bool(NotImplemented) is deprecated as of python 3.9
(fixes issue 125)
|
| | |
| |
| |
| |
| |
| |
| |
| | |
so instead of assuming safe_crypt() can only take UTF8 under py3,
and anything under py2; code is now tied to "crypt_accepts_bytes"
flag which does quick capability-detection when module loads.
this updates the changes from rev 67c619208229
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
issues
which were causing it to fail to generate a hash.
bcrypt
------
* _norm_digest(): fixed some PasslibValueError()s being thrown by os_crypt
backend during UT fuzz verifier. These were due to non-UTF8 input
being provided to crypt.crypt()... even though secret itself was UTF8 safe!
This was because secret was being truncated/repeated as part of
various backend bug workarounds; and the truncate/repeat operations
weren't being done in manner that respected UTF8 character boundaries.
This has now been fixed via _require_valid_utf8_bytes flag
(which has been set for os_crypt backend), that enables
utf8-safe mode of operation.
utils
-----
* added utf8_truncate() and utf8_repeat_string() helpers, for bcrypt fixes above.
* simplified repeat_string() internals
|
| | |
| |
| |
| |
| |
| | |
under py3,
since these can't be passed through crypt.crypt()
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
due to a few interlocking issues.
passlib.utils: test_crypt() shouldn't accept hash=<bytes>,
because equality comparison with str will always fail under py3.
* test_crypt() now enforces hash=<unicode_or_str> as input.
it previously allowed hash=bytes, but equality comparison
with unicode (output by safe_crypt) would always return False
under python 3.
* bcrypt's TEST_HASH_2A constant was stored bytes, which was causing os_crypt
detection to fail due to test_crypt() bug above. changed to use native str.
sidewnote: this would have been caught by UTs, except for bug in
test_82_crypt_support() that was fixed in rev 43bae3f786b7.
|
| | |
| |
| |
| | |
(fixes issue 115)
|
| | |
| |
| |
| | |
(fixes issue 113)
|
| |\ \
| |/ |
|
| | |
| |
| |
| |
| |
| | |
py26/33/34
(dict comprehensions and b"" % format directives both cause issues)
|
| |\ \
| |/ |
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| | |
This was a deprecation when running in Python 3.7:
DeprecationWarning: Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated, and in 3.8 it will stop working
if isinstance(source, collections.Sequence):
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
The function time.clock(), used in passlib/utils/__init__.py
has been removed. It was deprecated since Python 3.3.
More info:
https://docs.python.org/3.8/whatsnew/3.8.html#api-and-feature-removals
To make the code both Python 2 and 3 compatible, use timeit.default_timer
|
| | |
| |
| |
| |
| |
| |
| | |
realized can do this now that we're requiring python3 >= 3.3.
had to keep u() helper around for u(r"") instances, since py3 doesn't have ur"".
but switched it to use ascii decoding for py2, to make sure things are clean.
|
| |/
|
|
|
|
|
|
|
| |
scheduled
for removal in v1.8.
this removes CryptPolicy, unix_fallback, some old HtpasswdFile methods,
and more. tests were updated as well. see history/1.8 for a complete list.
|
| | |
|
| |
|
|
| |
about saslprep()
|
| |
|
|
| |
which doesn't use deprecated inspect.getargspec()
|
| |
|
|
| |
submodule
|
| | |
|
| |
|
|
|
| |
* moved has_active_backend() from UTs to .registry
* moved os_crypt backend support helper from .hosts to .registry
|
| |
|
|
| |
TOTP.normalize_time() turned into class method, made public.
|
| |
|
|
| |
fleshed out some edge cases in new update_mixin_classes() helper.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
These two classes have very complex backends, with lots of tests,
and backends that override multiple methods. Instead of awkwardly
patching a bunch of things on the class when backend is loaded,
redid these to use new strategy:
A base class (e.g. _BCryptCommon) is defined with all the common code,
and subclasses are defined for each backend (e.g. _PyBCryptBackend).
.set_backend() now dynamically modifies the bases of the hash class
to include the appropriate backend-specific subclass; allowing each
backend to easily override any methods it needs to.
Changes:
* Abstracted out the cls.__bases__ modifying code into SubclassBackendMixin
* Argon2 class split into multiple backend classes;
removes need for monkeypatching & redecorate_method() hack
* Bcrypt class split into multiple backend classes.
* Refactored bcrypt backend compatibility workaround tests:
- now initialized once for each backend, results stored in mixin class.
should make UTs switch backends MUCH faster
- tests for known bugs against all ident variants,
in case behaior is different between them.
- bug checks test for incorrect AND correct hashes,
to detect unexpected behaviors
- wraparound bug still handled for 2a, but now fatal for 2y/2by
- 2b ident now preferred as fallback if supported
|
| |
|
|
|
|
|
| |
* that commit made some small changes to utils.genseed() to improve extraction
of state from RNG. keeping that, but fixing typo in template.
* reverting some commented out notes that also got committed
|
| |
|
|
| |
(there will never be a 1.6.6)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
v1.6 deprecated the "min_verify_time" feature, since it required admins
to awkwardly hard-code the amount of time they wanted .verify() to take.
This was a useful feature, though, since it provided the ability for
contexts to mask which accounts had older, weaker, hashes.
This commit adds in a replacement feature: CryptContext now supports
a "harden_verify" flag, which causes it to autocalculate how long
the default hash should take, and make sure to spend at least that much time.
Another improvement is that this autocalc is performed at the context level,
not per hash like min_verify_time was, making it overall more reliable.
It also offers a new "context.dummy_verify()" call for faking the delay
for missing accounts.
Changes:
* Added "harden_verify" option to CryptContext,
along with code to autocalculate min_verify_time delay via timing
when context is first accessed.
XXX: this timing code needs some battle-testing, and may be adjusted later.
* Added .dummy_verify() method, integrated it into .verify()
and .verify_and_update().
* updated warnings & docs to report harden_verify as replacement
for "min_verify_time" option.
* to help workflow for adding delay on missing accounts,
.verify() and .verify_and_update() now support passing in hash=None,
and treat it as "never verifying"
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Added PasswordHash.truncate_size info attribute, to detect hashes
which truncate the password.
* All such hashes (bcrypt, des_crypt, some others) now accept a "truncate_error"
option, allowing them to be switched from silent truncation to throwing
an error instead. This option is also supported by CryptContext.
* tests/HandlerCase:
- removed .secret_size config flag, can now just read handler.truncate_size instead.
- reworked truncation tests to use new API, and test 'truncate_error' policy support.
|
| |
|
|
| |
fixed some places where > 32 bit values caused error under py27/win32.
|
| | |
|
| |
|
|
|
| |
avoiding base64.b64_decode()'s really slow altchars implementation, and
eliminating extra wrapper layer, by calling binascii.b2a_base64() directly.
|
| | |
|
| |
|
|
|
|
|
| |
* tweaked passlib's format to follow argon2 and
use explicit param names + normal base64 encoding
* added support for openwall's $7$ format
* moved hash tests to separate file
|
| |
|
|
|
|
|
|
|
|
| |
* passlib.handlers.argon2 module contains 'argon2' hasher class,
for both argon2_cffi & argon2pure packages as backends.
* added UTs from argon2 clib source, as well as some from argon2_cffi,
and some more custom hashes.
* UT harness: added limit so salt range test doesn't eat up all the memory under argon2.
|
| |
|
|
|
|
|
|
|
|
| |
which provides a more generic & flexible framework than HasManyBackends.
* has_backend() now a wrapper for set_backend(), which now accepts a dryrun flag.
* loaders can now return arbitrary objects, classes can control how they operate.
* loaders can now be dryrun aware.
* bcrypt hasher, scrypt hasher, and scrypt module updated to use new api
* fuzz tester now correctly restored backend after use
|
