hyperscale-stack / security / 38357947779

98%

master: 98%

Pull #120

github

fix(basic)!: refuse format and separator characters in Basic credentials

The Basic rules refused control characters only: invisible format
characters — zero-width joiner and space, soft hyphen, bidirectional
overrides and isolates, byte order mark, tags (Unicode Cf) — and the line
and paragraph separators (Zl, Zp) still reached the UserLoader, so a
user-id displaying as another one (with U+202E or U+200B inside) reached the
application's lookups and logs. RFC 7617 §2.1 points to RFC 8265's
OpaqueString and UsernameCasePreserved profiles, whose FreeformClass
(RFC 8264) disallows the separators and the default-ignorable code
points, the joiners outside a virama context included.

The Extractor and the Authenticator (form logins) now refuse these
characters in the user-id and in the password, with the same error as a
control character. Accented letters, emoji without a joiner, variation
selectors and no-break spaces are still accepted.

Breaking: an account whose password contains such a character — an
emoji sequence joined with U+200D, a pasted soft hyphen or byte order
mark — can no longer sign in with Basic. MIGRATION, LIMITATIONS and the
security considerations give the remedy: reset the password, and refuse
these characters when a password is set.

Audit: CORE-11.

525 of 527 new or added lines in 14 files covered. (99.62%)

13418 of 13655 relevant lines covered (98.26%)

5044.15 hits per line