b01a31c635
HTTPBasicAuth.correctPassword built its hash cache key with
append(account.password, plaintextPassword...). account.password is
shared by all requests and can have spare capacity, so short passwords
were written into the stored hash's backing array, causing a data race
between concurrent requests and potentially mixed-up cache keys.
Build the key in a fresh buffer instead, and add regression tests.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| caddyevents | ||
| caddyfs | ||
| caddyhttp | ||
| caddypki | ||
| caddytls | ||
| filestorage | ||
| internal/network | ||
| logging | ||
| metrics | ||
| standard | ||