MirrorHub/conduit
1
0
Fork 0
mirror of https://gitlab.com/famedly/conduit.git synced 2024-11-04 16:28:53 +01:00
Code Issues Releases Activity

Use simple BTreeMap to store uiaa requests

Browse source 
some uiaa requests contain plaintext passwords which should never be
persisted to disk.

Currently there is no cleanup implemented (you have to restart conduit)
This commit is contained in:
Moritz Bitsch 2021-10-20 06:20:34 +02:00
parent 9b57c89df6
commit 3d25d46dc5
2 changed files with 10 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/database.rs
View file

@ -250,8 +250,7 @@ impl Database {
},
uiaa: uiaa::Uiaa {
userdevicesessionid_uiaainfo: builder.open_tree("userdevicesessionid_uiaainfo")?,
userdevicesessionid_uiaarequest: builder
.open_tree("userdevicesessionid_uiaarequest")?,
userdevicesessionid_uiaarequest: RwLock::new(BTreeMap::new()),
},
rooms: rooms::Rooms {
edus: rooms::RoomEdus {

16
src/database/uiaa.rs
View file

@ -1,4 +1,6 @@
use std::sync::Arc;
use std::sync::RwLock;
use std::collections::BTreeMap;
use crate::{client_server::SESSION_ID_LENGTH, utils, Error, Result};
use ruma::{
@ -18,7 +20,7 @@ use super::abstraction::Tree;
pub struct Uiaa {
pub(super) userdevicesessionid_uiaainfo: Arc<dyn Tree>, // User-interactive authentication
pub(super) userdevicesessionid_uiaarequest: Arc<dyn Tree>, // UiaaRequest = canonical json value
pub(super) userdevicesessionid_uiaarequest: RwLock<BTreeMap<Vec<u8>, Vec<u8>>>, // UiaaRequest = canonical json value
}
impl Uiaa {
@ -153,10 +155,10 @@ impl Uiaa {
userdevicesessionid.push(0xff);
userdevicesessionid.extend_from_slice(session.as_bytes());
self.userdevicesessionid_uiaarequest.insert(
&userdevicesessionid,
&serde_json::to_vec(request).expect("json value to vec always works"),
)?;
self.userdevicesessionid_uiaarequest.write().unwrap().insert(
userdevicesessionid,
serde_json::to_vec(request).expect("json value to vec always works"),
);
Ok(())
}
@ -173,8 +175,8 @@ impl Uiaa {
userdevicesessionid.push(0xff);
userdevicesessionid.extend_from_slice(session.as_bytes());
self.userdevicesessionid_uiaarequest
.get(&userdevicesessionid)?
self.userdevicesessionid_uiaarequest.read().unwrap()
.get(&userdevicesessionid)
.map(|bytes| {
serde_json::from_str::<CanonicalJsonValue>(
&utils::string_from_bytes(&bytes)