f89626aa55
HTTPBasicAuth.correctPassword built its hash cache key with append(account.password, plaintextPassword...). account.password is shared by all requests and can have spare capacity, so short passwords were written into the stored hash's backing array, causing a data race between concurrent requests and potentially mixed-up cache keys. Build the key in a fresh buffer instead, and add regression tests. |
||
|---|---|---|
| .. | ||
| argon2id.go | ||
| basicauth.go | ||
| basicauth_test.go | ||
| bcrypt.go | ||
| caddyauth.go | ||
| caddyauth_test.go | ||
| caddyfile.go | ||
| command.go | ||
| command_test.go | ||
| hashes_test.go | ||