popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: replace crypto/md5 with crypto/sha256 for IP hashing

Browse Source
This commit is contained in:
popertots
2026-07-10 12:04:49 +01:00
parent d1e85bb855
commit ef3cfe8c4f
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/handlers/bookings/admin_reserve.go
+2 -2
View File
@@ -2,7 +2,7 @@ package bookings
import ( import (
"context" "context"
"crypto/md5" "crypto/sha256"
"crussell/clock" "crussell/clock"
"crussell/db" "crussell/db"
"crussell/handlers/scheduling" "crussell/handlers/scheduling"
@@ -152,7 +152,7 @@ func AdminReserveSlotHandler(w http.ResponseWriter, r *http.Request) {
ip = r.RemoteAddr ip = r.RemoteAddr
} }
} }
ipHash := fmt.Sprintf("%x", md5.Sum([]byte(ip)))[:8] ipHash := fmt.Sprintf("%x", sha256.Sum256([]byte(ip)))[:8]
if _, delErr := db.Conn.Exec(r.Context(), ` if _, delErr := db.Conn.Exec(r.Context(), `
DELETE FROM time_blockers DELETE FROM time_blockers
WHERE (description LIKE 'RESERVATION:admin:%' AND created_by = $1) WHERE (description LIKE 'RESERVATION:admin:%' AND created_by = $1)
backend/handlers/bookings/overlap_test.go
+3 -3
View File
@@ -5,7 +5,7 @@ package bookings
import ( import (
"bytes" "bytes"
"context" "context"
"crypto/md5" "crypto/sha256"
"encoding/json" "encoding/json"
"fmt" "fmt"
"net/http" "net/http"
@@ -1938,7 +1938,7 @@ func TestReserveSlot_CleansUpAnonReservation(t *testing.T) {
// Set a known IP that the test request will use // Set a known IP that the test request will use
testIP := "192.0.2.1" testIP := "192.0.2.1"
ipHash := fmt.Sprintf("%x", md5.Sum([]byte(testIP)))[:8] ipHash := fmt.Sprintf("%x", sha256.Sum256([]byte(testIP)))[:8]
// Create an anonymous reservation (created_by = NULL) matching this IP hash // Create an anonymous reservation (created_by = NULL) matching this IP hash
var blockerID string var blockerID string
@@ -2139,7 +2139,7 @@ func TestAdminReserveSlot_CleansUpAnonReservation(t *testing.T) {
future := weekdayTime(time.Monday, 10) future := weekdayTime(time.Monday, 10)
testIP := "192.0.2.2" testIP := "192.0.2.2"
ipHash := fmt.Sprintf("%x", md5.Sum([]byte(testIP)))[:8] ipHash := fmt.Sprintf("%x", sha256.Sum256([]byte(testIP)))[:8]
// Create an anonymous reservation matching this IP // Create an anonymous reservation matching this IP
var blockerID string var blockerID string
backend/handlers/bookings/reserve.go
+3 -3
View File
@@ -1,7 +1,7 @@
package bookings package bookings
import ( import (
"crypto/md5" "crypto/sha256"
"encoding/json" "encoding/json"
"fmt" "fmt"
"log" "log"
@@ -140,7 +140,7 @@ func ReserveSlotHandler(w http.ResponseWriter, r *http.Request) {
if hasAuth { if hasAuth {
// Also compute IP hash to clean up anonymous reservations // Also compute IP hash to clean up anonymous reservations
// that may have been created before the user logged in. // that may have been created before the user logged in.
ipHash := fmt.Sprintf("%x", md5.Sum([]byte(ip)))[:8] ipHash := fmt.Sprintf("%x", sha256.Sum256([]byte(ip)))[:8]
if _, delErr := db.Conn.Exec(r.Context(), ` if _, delErr := db.Conn.Exec(r.Context(), `
DELETE FROM time_blockers DELETE FROM time_blockers
WHERE (created_by = $1 AND description LIKE 'RESERVATION:user:%') WHERE (created_by = $1 AND description LIKE 'RESERVATION:user:%')
@@ -245,7 +245,7 @@ func ReserveSlotHandler(w http.ResponseWriter, r *http.Request) {
} }
} else { } else {
// Calculate ipHash from IP address // Calculate ipHash from IP address
ipHash := fmt.Sprintf("%x", md5.Sum([]byte(ip)))[:8] ipHash := fmt.Sprintf("%x", sha256.Sum256([]byte(ip)))[:8]
// ANONYMOUS: Use transaction for atomic rate cap + overlap check + insert // ANONYMOUS: Use transaction for atomic rate cap + overlap check + insert
tx, err := db.Conn.Begin(r.Context()) tx, err := db.Conn.Begin(r.Context())