hyperscale-stack / security / 38360773120

98%

master: 98%

Pull #120

github

test(session,basic): pin foreign authentication results, name user-ids

session.Authenticator.Authenticate returns security.Anonymous() when it
does not support the authentication it gets, but no test told that
return value from its input: the test passed security.Anonymous() itself.
It now passes a value of another type and asserts the anonymous result,
with the generated PrincipalLoader mock (never called) in place of the
hand-written loader.

The breaking note on format and separator characters named passwords
only: a user-id holding one — a Persian or Indic name written with
ZERO WIDTH NON-JOINER U+200C or ZERO WIDTH JOINER U+200D — is refused
too. CHANGELOG, MIGRATION, LIMITATIONS and the security considerations
now say so, with its remedy: rename the account or give it an alias.

Audit: CORE-11, CORE-15.

525 of 527 new or added lines in 14 files covered. (99.62%)

13738 of 13953 relevant lines covered (98.46%)

4947.53 hits per line