provvedo/wiregui
2
0
Fork 0
Code Issues Pull requests Projects Releases 6 Packages 1 Wiki Activity Actions

fix: address CodeQL findings — sha512 for token hashing, secure tempfile

Browse source
This commit is contained in:
Stefano Bertelli 2026-04-03 00:41:16 -05:00
parent aa38c3797e
commit 5c02598a46
3 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/e2e/test_idp_seed.py
View file

@ -166,8 +166,10 @@ async def test_seed_preserves_providers_not_in_yaml(clean_config, monkeypatch):
async def test_seed_invalid_yaml(clean_config, monkeypatch): async def test_seed_invalid_yaml(clean_config, monkeypatch):
path = Path(tempfile.mktemp(suffix=".yaml")) f = tempfile.NamedTemporaryFile(suffix=".yaml", delete=False, mode="w")
path.write_text(": : : invalid yaml [[[") f.write(": : : invalid yaml [[[")
f.close()
path = Path(f.name)
monkeypatch.setattr("wiregui.auth.seed.get_settings", lambda: type("S", (), {"idp_config_file": str(path)})()) monkeypatch.setattr("wiregui.auth.seed.get_settings", lambda: type("S", (), {"idp_config_file": str(path)})())
await seed_idp_providers() await seed_idp_providers()
async with async_session() as session: async with async_session() as session:

2
tests/test_api.py
View file

@ -15,7 +15,7 @@ from wiregui.utils.time import utcnow
def test_generate_api_token(): def test_generate_api_token():
plaintext, token_hash = generate_api_token() plaintext, token_hash = generate_api_token()
assert len(plaintext) > 20 assert len(plaintext) > 20
assert token_hash == hashlib.sha256(plaintext.encode()).hexdigest() assert token_hash == hashlib.sha512(plaintext.encode()).hexdigest()
def test_generate_api_token_unique(): def test_generate_api_token_unique():

4
wiregui/auth/api_token.py
View file

@ -15,13 +15,13 @@ from wiregui.utils.time import utcnow
def generate_api_token() -> tuple[str, str]: def generate_api_token() -> tuple[str, str]:
"""Generate a new API token. Returns (plaintext_token, token_hash).""" """Generate a new API token. Returns (plaintext_token, token_hash)."""
plaintext = secrets.token_urlsafe(32) plaintext = secrets.token_urlsafe(32)
token_hash = hashlib.sha256(plaintext.encode()).hexdigest() token_hash = hashlib.sha512(plaintext.encode()).hexdigest()
return plaintext, token_hash return plaintext, token_hash
async def resolve_bearer_token(session: AsyncSession, token: str) -> User | None: async def resolve_bearer_token(session: AsyncSession, token: str) -> User | None:
"""Look up a Bearer token and return the associated user, or None.""" """Look up a Bearer token and return the associated user, or None."""
token_hash = hashlib.sha256(token.encode()).hexdigest() token_hash = hashlib.sha512(token.encode()).hexdigest()
result = await session.execute( result = await session.execute(
select(ApiToken).where(ApiToken.token_hash == token_hash) select(ApiToken).where(ApiToken.token_hash == token_hash)
) )