cryptosphere / rust-macaroons

13%

master: 14%

LAST BUILD ON BRANCH tarcieri/remove-location-field

branch: tarcieri/remove-location-field

CHANGE BRANCH

x

Reset

• tarcieri/remove-location-field
• master
• optional-locations

Build # 96

Build Type

push

travis-ci

Committed by tarcieri

Commit Message

Remove support for the location tag

The location tag is malleable and therefore potentially attacker-controlled.
Unlike other caveats it can be removed or manipulated by an attacker holding
a Macaroon. This is surprising to me, and something I consider to be an
unnecessarily sharp edge in the format's design.

This change ignores the location field if present in Macaroons, and otherwise
removes it from macaroons::token::Token.

Run Details

845 of 6271 relevant lines covered (13.47%)

0.4 hits per line