mirrors/AdGuardHome
1
0
Fork 0
mirror of https://github.com/AdguardTeam/AdGuardHome.git synced 2024-11-22 21:15:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'auth-gosec-rand-ignore' of git://github.com/dsheets/AdGuardHome into dsheets-auth-gosec-rand-ignore

Browse source
This commit is contained in:
Andrey Meshkov 2020-09-08 15:24:38 +03:00
commit 3c2481f91d
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
home/auth.go
View file

@ -276,7 +276,11 @@ type loginJSON struct {
}
func getSession(u *User) []byte {
d := []byte(fmt.Sprintf("%d%s%s", rand.Uint32(), u.Name, u.PasswordHash))
// the developers don't currently believe that using a
// non-cryptographic RNG for the session hash salt is
// insecure
salt := rand.Uint32() //nolint:gosec
d := []byte(fmt.Sprintf("%d%s%s", salt, u.Name, u.PasswordHash))
hash := sha256.Sum256(d)
return hash[:]
}