fix(lint): fix all linting errors
- Check BindEnv return values in config.go - Add bounds checks for int->int32/uint32 conversions to prevent overflow - Remove unused test helper functions
This commit is contained in:
@@ -8,6 +8,7 @@ import (
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"math"
|
||||
"net"
|
||||
"strings"
|
||||
"time"
|
||||
@@ -72,7 +73,11 @@ func verifyPassword(password, hash string) (bool, error) {
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
actualHash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 4, uint32(len(expectedHash)))
|
||||
hashLen := len(expectedHash)
|
||||
if hashLen < 0 || hashLen > math.MaxUint32 {
|
||||
return false, fmt.Errorf("invalid hash length: %d", hashLen)
|
||||
}
|
||||
actualHash := argon2.IDKey([]byte(password), salt, 3, 64*1024, 4, uint32(hashLen))
|
||||
return subtle.ConstantTimeCompare(expectedHash, actualHash) == 1, nil
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user