From 244ef0cb8f82b18c22990ece728f2e1fe8398a62 Mon Sep 17 00:00:00 2001 From: MeiMei <30769358+mei23@users.noreply.github.com> Date: Sun, 29 Mar 2020 23:16:36 +0900 Subject: [PATCH] =?UTF-8?q?=E3=83=88=E3=83=BC=E3=82=AF=E3=83=B3=E7=B3=BB?= =?UTF-8?q?=E3=81=AE=E4=B9=B1=E6=95=B0=E3=82=BD=E3=83=BC=E3=82=B9=E3=81=A7?= =?UTF-8?q?=E3=81=AFcrypto=E3=82=92=E4=BD=BF=E3=81=86=E3=82=88=E3=81=86?= =?UTF-8?q?=E3=81=AB=20(#6200)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/misc/secure-rndstr.ts | 21 +++++++++++++++++++ .../api/common/generate-native-user-token.ts | 4 ++-- src/server/api/endpoints/app/create.ts | 4 ++-- src/server/api/endpoints/auth/accept.ts | 4 ++-- src/server/api/endpoints/miauth/gen-token.ts | 4 ++-- 5 files changed, 29 insertions(+), 8 deletions(-) create mode 100644 src/misc/secure-rndstr.ts diff --git a/src/misc/secure-rndstr.ts b/src/misc/secure-rndstr.ts new file mode 100644 index 0000000000..76ee1225eb --- /dev/null +++ b/src/misc/secure-rndstr.ts @@ -0,0 +1,21 @@ +import * as crypto from 'crypto'; + +const L_CHARS = '0123456789abcdefghijklmnopqrstuvwxyz'; +const LU_CHARS = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; + +export function secureRndstr(length = 32, useLU = true): string { + const chars = useLU ? LU_CHARS : L_CHARS; + const chars_len = chars.length; + + let str = ''; + + for (let i = 0; i < length; i++) { + let rand = Math.floor((crypto.randomBytes(1).readUInt8(0) / 0xFF) * chars_len); + if (rand === chars_len) { + rand = chars_len - 1; + } + str += chars.charAt(rand); + } + + return str; +} diff --git a/src/server/api/common/generate-native-user-token.ts b/src/server/api/common/generate-native-user-token.ts index a372221a0a..cd30ba98f9 100644 --- a/src/server/api/common/generate-native-user-token.ts +++ b/src/server/api/common/generate-native-user-token.ts @@ -1,3 +1,3 @@ -import rndstr from 'rndstr'; +import { secureRndstr } from '../../../misc/secure-rndstr'; -export default () => rndstr('a-zA-Z0-9', 16); +export default () => secureRndstr(16, true); diff --git a/src/server/api/endpoints/app/create.ts b/src/server/api/endpoints/app/create.ts index ac3e8a18d2..776865ffb6 100644 --- a/src/server/api/endpoints/app/create.ts +++ b/src/server/api/endpoints/app/create.ts @@ -1,9 +1,9 @@ -import rndstr from 'rndstr'; import $ from 'cafy'; import define from '../../define'; import { Apps } from '../../../../models'; import { genId } from '../../../../misc/gen-id'; import { unique } from '../../../../prelude/array'; +import { secureRndstr } from '../../../../misc/secure-rndstr'; export const meta = { tags: ['app'], @@ -60,7 +60,7 @@ export const meta = { export default define(meta, async (ps, user) => { // Generate secret - const secret = rndstr('a-zA-Z0-9', 32); + const secret = secureRndstr(32, true); // for backward compatibility const permission = unique(ps.permission.map(v => v.replace(/^(.+)(\/|-)(read|write)$/, '$3:$1'))); diff --git a/src/server/api/endpoints/auth/accept.ts b/src/server/api/endpoints/auth/accept.ts index 8ba15ba815..e9281f1236 100644 --- a/src/server/api/endpoints/auth/accept.ts +++ b/src/server/api/endpoints/auth/accept.ts @@ -1,4 +1,3 @@ -import rndstr from 'rndstr'; import * as crypto from 'crypto'; import $ from 'cafy'; import define from '../../define'; @@ -6,6 +5,7 @@ import { ApiError } from '../../error'; import { AuthSessions, AccessTokens, Apps } from '../../../../models'; import { genId } from '../../../../misc/gen-id'; import { ensure } from '../../../../prelude/ensure'; +import { secureRndstr } from '../../../../misc/secure-rndstr'; export const meta = { tags: ['auth'], @@ -39,7 +39,7 @@ export default define(meta, async (ps, user) => { } // Generate access token - const accessToken = rndstr('a-zA-Z0-9', 32); + const accessToken = secureRndstr(32, true); // Fetch exist access token const exist = await AccessTokens.findOne({ diff --git a/src/server/api/endpoints/miauth/gen-token.ts b/src/server/api/endpoints/miauth/gen-token.ts index efa8680805..d8c74ec8d7 100644 --- a/src/server/api/endpoints/miauth/gen-token.ts +++ b/src/server/api/endpoints/miauth/gen-token.ts @@ -1,8 +1,8 @@ -import rndstr from 'rndstr'; import $ from 'cafy'; import define from '../../define'; import { AccessTokens } from '../../../../models'; import { genId } from '../../../../misc/gen-id'; +import { secureRndstr } from '../../../../misc/secure-rndstr'; export const meta = { tags: ['auth'], @@ -36,7 +36,7 @@ export const meta = { export default define(meta, async (ps, user) => { // Generate access token - const accessToken = rndstr('a-zA-Z0-9', 32); + const accessToken = secureRndstr(32, true); // Insert access token doc await AccessTokens.save({