IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-07-30 00:08:10 -05:00
Code Issues Packages Projects Releases Wiki Activity

Auth: Use SHA-1 for generating an ID for External Service Role (#71079)

Browse Source 
* Use sha1 (160 bit hash)

* Update pkg/services/accesscontrol/database/externalservices.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Satisfy linter, clean up

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
This commit is contained in:
Misi
2023-07-10 09:47:33 +02:00
committed by GitHub
co-authored by Gabriel MABILLE
parent ae5d9e9ae4
commit 607670a9fa
2 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/database/externalservices.go
+9 -1
View File
@@ -2,6 +2,9 @@ package database
import (
"context"
// #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes
"crypto/sha1"
"encoding/hex"
"errors"
"fmt"
"time"
@@ -10,9 +13,14 @@ import (
"github.com/grafana/grafana/pkg/services/accesscontrol"
)
// extServiceRoleUID generates a 160 bit unique ID using SHA-1 that fits within the 40 characters limit of the role UID.
func extServiceRoleUID(externalServiceID string) string {
uid := fmt.Sprintf("%s%s_permissions", accesscontrol.ExternalServiceRoleUIDPrefix, externalServiceID)
return uid
// #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes
hasher := sha1.New()
hasher.Write([]byte(uid))
return hex.EncodeToString(hasher.Sum(nil))
}
func extServiceRoleName(externalServiceID string) string {
pkg/services/accesscontrol/database/externalservices_test.go
+10 -1
View File
@@ -2,6 +2,9 @@ package database
import (
"context"
// #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes
"crypto/sha1"
"encoding/hex"
"errors"
"fmt"
"testing"
@@ -163,7 +166,7 @@ func TestAccessControlStore_SaveExternalServiceRole(t *testing.T) {
require.NoError(t, err)
errDBSession := s.sql.WithDbSession(ctx, func(sess *db.Session) error {
storedRole, err := getRoleByUID(ctx, sess, fmt.Sprintf("externalservice_%s_permissions", tt.runs[i].cmd.ExternalServiceID))
storedRole, err := getRoleByUID(ctx, sess, sha1Hash(fmt.Sprintf("externalservice_%s_permissions", tt.runs[i].cmd.ExternalServiceID)))
require.NoError(t, err)
require.NotNil(t, storedRole)
require.Equal(t, tt.runs[i].cmd.Global, storedRole.Global(), "Incorrect global state of the role")
@@ -300,3 +303,9 @@ func TestAccessControlStore_DeleteExternalServiceRole(t *testing.T) {
})
}
}
func sha1Hash(text string) string {
h := sha1.New()
_, _ = h.Write([]byte(text))
return hex.EncodeToString(h.Sum(nil))
}