hyperscale-stack / security

98%

master: 98%

LAST BUILD ON BRANCH fix/audit-session-password-basic

branch: fix/audit-session-password-basic

CHANGE BRANCH

x

Reset

Sync Branches

• fix/audit-session-password-basic
• ci/real-db-stores
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/checkout-7
• dependabot/github_actions/actions/setup-go-7
• dependabot/github_actions/softprops/action-gh-release-3
• dependabot/go_modules/connectrpc.com/connect-1.21.0
• dependabot/go_modules/connectrpc.com/connect-1.21.1
• dependabot/go_modules/connectrpc.com/grpchealth-1.5.0
• dependabot/go_modules/github.com/alicebob/miniredis/v2-2.39.0
• dependabot/go_modules/github.com/alicebob/miniredis/v2-2.40.0
• dependabot/go_modules/github.com/chromedp/cdproto-0.157.9
• dependabot/go_modules/github.com/chromedp/cdproto-0.158.0
• dependabot/go_modules/github.com/chromedp/cdproto-0.158.4
• dependabot/go_modules/github.com/chromedp/chromedp-0.20.1
• dependabot/go_modules/github.com/chromedp/chromedp-0.21.0
• dependabot/go_modules/github.com/go-jose/go-jose/v4-4.1.5
• dependabot/go_modules/github.com/redis/go-redis/v9-9.19.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.20.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.20.1
• dependabot/go_modules/github.com/redis/go-redis/v9-9.21.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.22.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.23.0
• dependabot/go_modules/github.com/rs/zerolog-1.35.0
• dependabot/go_modules/github.com/rs/zerolog-1.35.1
• dependabot/go_modules/github.com/stretchr/testify-1.12.1
• dependabot/go_modules/github.com/zitadel/oidc/v3-3.51.16
• dependabot/go_modules/go.opentelemetry.io/otel-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel-1.45.0
• dependabot/go_modules/go.opentelemetry.io/otel-1.46.0
• dependabot/go_modules/go.opentelemetry.io/otel-1.47.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.45.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.46.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.47.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.45.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.46.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.47.0
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/go_modules/golang.org/x/crypto-0.46.0
• dependabot/go_modules/golang.org/x/crypto-0.47.0
• dependabot/go_modules/golang.org/x/crypto-0.48.0
• dependabot/go_modules/golang.org/x/crypto-0.49.0
• dependabot/go_modules/golang.org/x/crypto-0.50.0
• dependabot/go_modules/golang.org/x/crypto-0.51.0
• dependabot/go_modules/golang.org/x/crypto-0.52.0
• dependabot/go_modules/golang.org/x/crypto-0.53.0
• dependabot/go_modules/golang.org/x/crypto-0.54.0
• dependabot/go_modules/golang.org/x/crypto-0.55.0
• dependabot/go_modules/golang.org/x/crypto-0.56.0
• dependabot/go_modules/golang.org/x/crypto-0.57.0
• dependabot/go_modules/google.golang.org/grpc-1.81.1
• dependabot/go_modules/google.golang.org/grpc-1.82.0
• dependabot/go_modules/google.golang.org/grpc-1.82.1
• dependabot/go_modules/google.golang.org/grpc-1.83.0
• dependabot/go_modules/google.golang.org/grpc-1.83.1
• dependabot/go_modules/google.golang.org/grpc-1.83.2
• dependabot/go_modules/google.golang.org/grpc-1.84.0
• dependabot/go_modules/modernc.org/sqlite-1.51.0
• dependabot/go_modules/modernc.org/sqlite-1.52.0
• dependabot/go_modules/modernc.org/sqlite-1.53.0
• dependabot/go_modules/modernc.org/sqlite-1.54.0
• dependabot/go_modules/modernc.org/sqlite-1.56.0
• dependabot/go_modules/modernc.org/sqlite-1.57.0
• dependabot/go_modules/modernc.org/sqlite-1.58.0
• dependabot/go_modules/modernc.org/sqlite-1.60.1
• dependabot/go_modules/modernc.org/sqlite-1.61.0
• dependabot/go_modules/tools/osv-scanner/golang.org/x/vuln-1.9.0
• feat/audit2-attempt-limiter
• feature/63-oauth2-error-hook
• feature/64-oauth2-expires-in-clock
• feature/78-oauth2-refresh-rotation-profile
• feature/79-oauth2-pkce-syntax
• feature/80-oauth2-code-replay-revocation
• feature/81-oauth2-introspection-authz
• feature/82-oauth2-refresh-family-revocation
• feature/83-oauth2-oidc-extension-points
• feature/84-oidc-provider
• feature/85-oidc-client
• feature/86-oidc-interop
• feature/87-saml-sp
• feature/88-saml-adversarial-interop
• feature/94-oauth2-empty-client-secret
• feature/connectrpc
• feature/oauth2-server
• feature/refactoring
• fix/audit-ci-deps
• fix/audit-core-transport
• fix/audit-jwt
• fix/audit-oauth2-client-policy
• fix/audit-oauth2-endpoints
• fix/audit-oidc-client
• fix/audit-oidc-provider
• fix/audit-saml-sp
• fix/audit-sql-stores
• fix/audit2-core
• fix/audit2-jose
• fix/audit2-jwt
• fix/audit2-oauth2-front
• fix/audit2-oidc-client
• fix/audit2-oidc-provider
• fix/audit2-saml
• fix/audit2-stores
• fix/audit2-supply-chain
• master

Build # 38360773120

Build Type

Pull #120

github

Committed by euskadi31

Commit Message

test(session,basic): pin foreign authentication results, name user-ids

session.Authenticator.Authenticate returns security.Anonymous() when it
does not support the authentication it gets, but no test told that
return value from its input: the test passed security.Anonymous() itself.
It now passes a value of another type and asserts the anonymous result,
with the generated PrincipalLoader mock (never called) in place of the
hand-written loader.

The breaking note on format and separator characters named passwords
only: a user-id holding one — a Persian or Indic name written with
ZERO WIDTH NON-JOINER U+200C or ZERO WIDTH JOINER U+200D — is refused
too. CHANGELOG, MIGRATION, LIMITATIONS and the security considerations
now say so, with its remedy: rename the account or give it an alias.

Audit: CORE-11, CORE-15.

Pull Request Pull Request #120: fix(session,password,basic)!: close the security audit findings of the session, password and HTTP Basic modules

Coverage Stats

525 of 527 new or added lines in 14 files covered. (99.62%)

13738 of 13953 relevant lines covered (98.46%)

4947.53 hits per line