Git-Mirrors/onionshare
1
0
Fork 0
mirror of https://github.com/onionshare/onionshare.git synced 2025-03-01 10:51:10 -05:00
Code Issues Packages Projects Releases Wiki Activity

constant time compare the slug to avoid timing attacks

Browse Source
This commit is contained in:
Garrett Robinson 2014-07-03 13:06:46 -07:00
parent 05ec78dc34
commit 426d744d58
1 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
onionshare/onionshare.py
View File

@ -6,7 +6,12 @@ from functools import wraps
from stem.control import Controller from stem.control import Controller
from stem import SocketError from stem import SocketError
from flask import Flask, Markup, Response, request, make_response, send_from_directory, render_template_string from flask import Flask, Markup, Response, request, make_response, send_from_directory, render_template_string, abort
# Flask depends on itsdangerous, which needs constant time string comparison
# for the HMAC values in secure cookies. Since we know itsdangerous is
# available, we just use its function.
from itsdangerous import constant_time_compare
class NoTor(Exception): class NoTor(Exception):
pass pass
@ -73,9 +78,13 @@ def human_readable_filesize(b):
u += 1 u += 1
return '{0} {1}'.format(round(b, 1), units[u]) return '{0} {1}'.format(round(b, 1), units[u])
@app.route("/{0}".format(slug)) @app.route("/<slug_candidate>")
def index(): def index(slug_candidate):
global filename, filesize, filehash, slug, strings, REQUEST_LOAD, onionshare_dir global filename, filesize, filehash, slug, strings, REQUEST_LOAD, onionshare_dir
if not constant_time_compare(slug, slug_candidate):
abort(404)
add_request(REQUEST_LOAD, request.path) add_request(REQUEST_LOAD, request.path)
return render_template_string( return render_template_string(
open('{0}/index.html'.format(onionshare_dir)).read(), open('{0}/index.html'.format(onionshare_dir)).read(),
@ -87,11 +96,14 @@ def index():
strings=strings strings=strings
) )
@app.route("/{0}/download".format(slug)) @app.route("/<slug_candidate>/download")
def download(): def download(slug_candidate):
global filename, filesize, q, download_count global filename, filesize, q, download_count
global REQUEST_DOWNLOAD, REQUEST_PROGRESS global REQUEST_DOWNLOAD, REQUEST_PROGRESS
if not constant_time_compare(slug, slug_candidate):
abort(404)
# each download has a unique id # each download has a unique id
download_id = download_count download_id = download_count
download_count += 1 download_count += 1