From 607670a9fafc141b2303cc6ee1b780250f30317e Mon Sep 17 00:00:00 2001 From: Misi Date: Mon, 10 Jul 2023 09:47:33 +0200 Subject: [PATCH] Auth: Use SHA-1 for generating an ID for External Service Role (#71079) * Use sha1 (160 bit hash) * Update pkg/services/accesscontrol/database/externalservices.go Co-authored-by: Gabriel MABILLE * Satisfy linter, clean up --------- Co-authored-by: Gabriel MABILLE --- .../accesscontrol/database/externalservices.go | 10 +++++++++- .../accesscontrol/database/externalservices_test.go | 11 ++++++++++- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/pkg/services/accesscontrol/database/externalservices.go b/pkg/services/accesscontrol/database/externalservices.go index ea9d1af1807..9acadc786d7 100644 --- a/pkg/services/accesscontrol/database/externalservices.go +++ b/pkg/services/accesscontrol/database/externalservices.go @@ -2,6 +2,9 @@ package database import ( "context" + // #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes + "crypto/sha1" + "encoding/hex" "errors" "fmt" "time" @@ -10,9 +13,14 @@ import ( "github.com/grafana/grafana/pkg/services/accesscontrol" ) +// extServiceRoleUID generates a 160 bit unique ID using SHA-1 that fits within the 40 characters limit of the role UID. func extServiceRoleUID(externalServiceID string) string { uid := fmt.Sprintf("%s%s_permissions", accesscontrol.ExternalServiceRoleUIDPrefix, externalServiceID) - return uid + // #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes + hasher := sha1.New() + hasher.Write([]byte(uid)) + + return hex.EncodeToString(hasher.Sum(nil)) } func extServiceRoleName(externalServiceID string) string { diff --git a/pkg/services/accesscontrol/database/externalservices_test.go b/pkg/services/accesscontrol/database/externalservices_test.go index 6f90350b76a..219506f9622 100644 --- a/pkg/services/accesscontrol/database/externalservices_test.go +++ b/pkg/services/accesscontrol/database/externalservices_test.go @@ -2,6 +2,9 @@ package database import ( "context" + // #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes + "crypto/sha1" + "encoding/hex" "errors" "fmt" "testing" @@ -163,7 +166,7 @@ func TestAccessControlStore_SaveExternalServiceRole(t *testing.T) { require.NoError(t, err) errDBSession := s.sql.WithDbSession(ctx, func(sess *db.Session) error { - storedRole, err := getRoleByUID(ctx, sess, fmt.Sprintf("externalservice_%s_permissions", tt.runs[i].cmd.ExternalServiceID)) + storedRole, err := getRoleByUID(ctx, sess, sha1Hash(fmt.Sprintf("externalservice_%s_permissions", tt.runs[i].cmd.ExternalServiceID))) require.NoError(t, err) require.NotNil(t, storedRole) require.Equal(t, tt.runs[i].cmd.Global, storedRole.Global(), "Incorrect global state of the role") @@ -300,3 +303,9 @@ func TestAccessControlStore_DeleteExternalServiceRole(t *testing.T) { }) } } + +func sha1Hash(text string) string { + h := sha1.New() + _, _ = h.Write([]byte(text)) + return hex.EncodeToString(h.Sum(nil)) +}