awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-10 19:28:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed log and fixed comments

Browse Source
This commit is contained in:
Joel Biddle
2023-08-22 23:36:24 +10:00
parent 3e36adcf5c
commit 52c4f64655
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/components/utilities/checks/checkIsPasswordBreached.ts
+8 -8
View File
@@ -4,9 +4,9 @@ import crypto from "crypto"; // added types from @types/node
export const checkIsPasswordBreached = async (password: string) => { export const checkIsPasswordBreached = async (password: string) => {
// see API details here: https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange // see API details here: https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange
// in short, the pending password is hashed (SHA-1), the first 5 chars are sliced and compared against a ranged hash table // in short, the pending password is hashed (SHA-1), the first 5 chars are sliced and compared against a ranged hash table
// if there is a match, that password has been involved in a password breach and should not be accepted // if there is a match, that password has been involved in a password breach and should NOT be accepted
// the database consists of ~700 mln breached passwords and is continuously updated // the database consists of ~700 mln breached passwords and is continuously updated, including with law enforcement ingestion
// https://www.troyhunt.com/open-source-pwned-passwords-with-fbi-feed-and-225m-new-nca-passwords-is-now-live/ // https://www.troyhunt.com/open-source-pwned-passwords-with-fbi-feed-and-225m-new-nca-passwords-is-now-live/
const dataBreachCheckAPIBaseURL = "https://api.pwnedpasswords.com/range/"; // added to CSP const dataBreachCheckAPIBaseURL = "https://api.pwnedpasswords.com/range/"; // added to CSP
@@ -21,16 +21,16 @@ export const checkIsPasswordBreached = async (password: string) => {
.join("") .join("")
.toUpperCase(); .toUpperCase();
const hashedPwdToSend = hashedPwd.slice(0, 5); // ONLY the first five SHA-1 hash chars are sent over HTTPS (the whole string can be sent but that's not very secure due to SHA-1 flaws) // ONLY the first five SHA-1 hash chars need to be sent (must be over HTTPS)
const hashedPwdToSend = hashedPwd.slice(0, 5);
const response = await axios.get(`${dataBreachCheckAPIBaseURL}${hashedPwdToSend}`); const response = await axios.get(`${dataBreachCheckAPIBaseURL}${hashedPwdToSend}`);
const responseData = response.data.toUpperCase(); const responseData = response.data.toUpperCase();
const isBreachedPassword = responseData.includes(hashedPwd.slice(5, 40)); // compare against the API's ranged db's hash table // compare against the API's ranged db's hash table
const isBreachedPassword = responseData.includes(hashedPwd.slice(5, 40));
console.log("isBreachedPassword:", isBreachedPassword); // remove log later
// Clear the hashed password from memory
// Clear the hashed password from memory as a precaution
const zeroBuffer = new Uint8Array(encodedPwd.length); const zeroBuffer = new Uint8Array(encodedPwd.length);
encodedPwd.set(zeroBuffer); encodedPwd.set(zeroBuffer);
@@ -39,7 +39,7 @@ export const checkIsPasswordBreached = async (password: string) => {
if (axios.isAxiosError(err) && err.response && err.response.status === 429) { if (axios.isAxiosError(err) && err.response && err.response.status === 429) {
console.error("Received a 429 response from the Pwnd Passwords API"); console.error("Received a 429 response from the Pwnd Passwords API");
// Handle the 429 error here (not 100% sure what the rate limits are for the password API but looks like <10 calls/min) // Handle the 429 error here (not 100% sure what the rate limits are for the password API but looks like <10 calls/min)
// an error here should not cause the setting/resetting/changing password to fail (unless desired) // an error here should probably not cause the setting/resetting/changing password to fail (unless desired)
} else { } else {
console.error(err); console.error(err);
} }