Summary:

Add checksum checking when validating VendorChecksum API tokens.

Review Request #12663 — Created Oct. 3, 2022 and submitted Oct. 31, 2022, 2:30 p.m.

Information
Owner:	maubin
Repository:	Djblets
Branch:	release-3.x
Bugs:
Depends On:
Blocks:	12651
Reviewers
Groups:	djblets
People:

Description

This change makes the VendorChecksumTokenGenerator check the token's checksum
when validating tokens. This makes the token validation more precise and is
useful for weeding out any false positives during secret scanning.

This also fixes the character set that we're using for base62-encoding the
token checksums. The previous one had incorrectly swapped the placement of the
capital and lowercase characters in the set. Tokens that were generated using
the old character set are still considered valid.

Testing Done

Ran unit tests.

Commits

Summary
Add checksum checking when validating VendorChecksum API tokens.

Screenshots

Issues

Description	From	Last Updated
We might just want to compare against checksum.swapcase() in the conditional directly, so that we don't perform this operation unless …	chipx86	Oct. 28, 2022, 1:29 p.m.

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```

Change Summary:

Fixes the base62-encoding character set and still validates tokens that use our previous faulty base62-encoding.

Description:

		This change makes the `VendorChecksumTokenGenerator` check the token's checksum
		when validating tokens. This makes the token validation more precise and is
		useful for weeding out any false positives during secret scanning.
	+
	+	This also fixes the character set that we're using for base62-encoding the
	+	token checksums. The previous one had incorrectly swapped the placement of the
	+	capital and lowercase characters in the set. Tokens that were generated using
	+	the old character set are still considered valid.

Commits:

	Summary
-	Add checksum checking when validating VendorChecksum API tokens.
+	Add checksum checking when validating VendorChecksum API tokens.

Diff:

Revision 2 (+142 -44)

Show changes

	djblets/secrets/tests/test_vendor_checksum_token_generator.py
	djblets/secrets/token_generators/vendor_checksum.py

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

djblets/secrets/token_generators/vendor_checksum.py (Diff revisions 1 - 2)

Show all issues

We might just want to compare against checksum.swapcase() in the conditional directly, so that we don't perform this operation unless it appears to be a valid token but the checksum fails. That'll be the rare case.

Change Summary:

Compares against checksum.swapcase() directly in the conditional so that the swapcase operation only happens if it needs to.

Commits:

	Summary
-	Add checksum checking when validating VendorChecksum API tokens.
+	Add checksum checking when validating VendorChecksum API tokens.

Diff:

Revision 3 (+140 -46)

Show changes

	djblets/secrets/tests/test_vendor_checksum_token_generator.py
	djblets/secrets/token_generators/vendor_checksum.py

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```

Status: Closed (submitted)

Change Summary:

Pushed to release-3.x (6b692e6)