From b8e4ce754ea8a80b475f498fc7f8ca166815ad91 Mon Sep 17 00:00:00 2001 From: zeripath Date: Tue, 15 Jun 2021 23:29:25 +0100 Subject: [PATCH] Only check access tokens if they are likely to be tokens (#16164) * Only check access tokens if they are likely to be tokens Gitea will currently check every if every password is an access token even though most passwords are not and cannot be access tokens. By creation access tokens are 40 byte hexadecimal strings therefore only these should be checked. Signed-off-by: Andrew Thornton --- models/token.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/models/token.go b/models/token.go index 4737dddda3..357afe44a7 100644 --- a/models/token.go +++ b/models/token.go @@ -57,9 +57,15 @@ func GetAccessTokenBySHA(token string) (*AccessToken, error) { if token == "" { return nil, ErrAccessTokenEmpty{} } - if len(token) < 8 { + // A token is defined as being SHA1 sum these are 40 hexadecimal bytes long + if len(token) != 40 { return nil, ErrAccessTokenNotExist{token} } + for _, x := range []byte(token) { + if x < '0' || (x > '9' && x < 'a') || x > 'f' { + return nil, ErrAccessTokenNotExist{token} + } + } var tokens []AccessToken lastEight := token[len(token)-8:] err := x.Table(&AccessToken{}).Where("token_last_eight = ?", lastEight).Find(&tokens)