bleedingdeacons / integrity / 34296310851
91%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 15
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 90.05% (-0.2%) from 90.222%
34296310851

push

github

web-flow 
fix: bound the Argon2id work an unauthenticated caller can command (#70)

validateKey() deliberately runs a fixed eight password_verify() calls so a
prefix miss costs the same as a hit, and dummyHash() adds a ninth on first
use. All nine are Argon2id at memory_cost 65536 / time_cost 4. The per-key
RateLimiter cannot cover any of it: checkAndIncrement() keys on an id that
only a successful validation produces, so a caller presenting an unknown
key was never counted and had no limit at all. Every rejection also wrote a
row to the audit table.

Three layers, cheapest first.

looksLikeKey() checks the shape generateKey() actually emits — 'int_' plus
64 lowercase hex — and validateKey() refuses anything else before the query
and before any hashing. This does not reopen the oracle dummyHash() closes:
the key format is public, and every well-formed candidate still runs the
full fixed-cost verify loop. A test asserts that, so a later short-circuit
of well-formed keys fails rather than silently restoring the leak.

PreAuthThrottle bounds well-formed but invalid keys at 20 failed attempts
per IP per 15-minute window, answering with 429 and Retry-After. It is
transient-backed rather than a fourth table: the schema is created once in
the activation hook with no version-gated migration, so a new table would
not appear on already-activated installs, which is where this has to work.
It keys on AuditLogger::getClientIp(), which only honours proxy headers
from configured trusted proxies, so the bucket cannot be scattered by
forging X-Forwarded-For. A working key costs one transient read and never
accumulates a count.

The check sits ahead of every rejection path, not just key validation. The
CPU was one of two unbounded costs; the other was an audit insert per
refusal, which a keyless or plain-HTTP flood reached without touching
Argon2id at all. So those paths charge the budget too, and a throttled
request writes nothing to the audit table — the attempts that establis... (continued)

2679 of 2975 relevant lines covered (90.05%)

4.25 hits per line

Coverage Regressions

Lines Coverage ∆ File
31
91.42
-1.37% integrity/integrity/src/Api/RestController.php
30
48.35
0.08% integrity/integrity/src/Plugin.php
7
95.81
0.1% integrity/integrity/src/Auth/ApiKeyManager.php
Jobs
ID Job ID Ran Files Coverage
1 34296310851.1 15
90.05
GitHub Action Run
Source Files on build 34296310851