Repository: zulip/zulip

Issue:
Use SHA-256 for BigBlueButton checksums
BigBlueButton's API uses SHA1 for its checksum; I marked is as dismissed for CodeQL since it's not something we can directly change without SHA256 support in BigBlueButton itself.  I note that https://github.com/bigbluebutton/bigbluebutton/issues/17135 and related issues suggest it might be possible to do so today, though apparently the way to do that may not be documented.  So probably not something we can change without testing with a running BigBlueButton instance.

Noticed by GitHub Actions in https://github.com/zulip/zulip/pull/19962; I disabled the CodeQL warning for this so CI remains happy.

@strifel FYI as the original author of our BigBlueButton plugin.


Discussion:
Hello @zulip/server-integrations members, this issue was labeled with the "area: integrations" label, so you may want to check it out!

<!-- areaLabelAddition -->

> Noticed by GitHub Actions in #19962; I disabled the CodeQL warning for this so CI remains happy.

(This has no effect on whether CI remains happy. The CodeQL action complains about new warnings *relative* to `main`. This is why CI was happy before #19962 even though CodeQL already knew about this error.)
Makes sense -- I figured this was a result of a function signature change.  But still good to have this in the tracker, since it appears BigBlueButton may allow us to change things.
Just tested this.
It works fine with a BigBlueButton server.
It does not with Scalelite v1.3, but the support for SHA1 is already on master and in v1.3.1-beta.1.

Resolving patch:
diff --git a/zerver/views/video_calls.py b/zerver/views/video_calls.py
--- a/zerver/views/video_calls.py
+++ b/zerver/views/video_calls.py
@@ -178,7 +178,7 @@ def get_bigbluebutton_url(request: HttpRequest, user_profile: UserProfile) -> Ht
     # https://docs.bigbluebutton.org/dev/api.html#usage for reference for checksum
     id = "zulip-" + str(random.randint(100000000000, 999999999999))
     password = b32encode(secrets.token_bytes(7))[:10].decode()
-    checksum = hashlib.sha1(
+    checksum = hashlib.sha256(
         (
             "create"
             + "meetingID="
@@ -257,7 +257,7 @@ def join_bigbluebutton(
             quote_via=quote,
         )
 
-        checksum = hashlib.sha1(
+        checksum = hashlib.sha256(
             ("join" + join_params + settings.BIG_BLUE_BUTTON_SECRET).encode()
         ).hexdigest()
         redirect_url_base = append_url_query_string(


Test patch:
diff --git a/zerver/tests/test_create_video_call.py b/zerver/tests/test_create_video_call.py
--- a/zerver/tests/test_create_video_call.py
+++ b/zerver/tests/test_create_video_call.py
@@ -175,7 +175,7 @@ def test_create_bigbluebutton_link(self) -> None:
             self.assertEqual(
                 response.json()["url"],
                 "/calls/bigbluebutton/join?meeting_id=zulip-1&password=AAAAAAAAAA"
-                "&checksum=697939301a52d3a2f0b3c3338895c1a5ab528933",
+                "&checksum=d5eb2098bcd0e69a33caf2b18490991b843c8fa6be779316b4303c7990aca687",
             )
 
     @responses.activate
@@ -194,7 +194,7 @@ def test_join_bigbluebutton_redirect(self) -> None:
         self.assertEqual(
             response.url,
             "https://bbb.example.com/bigbluebutton/api/join?meetingID=zulip-1&password=a"
-            "&fullName=King%20Hamlet&checksum=7ddbb4e7e5aa57cb8c58db12003f3b5b040ff530",
+            "&fullName=King%20Hamlet&checksum=ca78d6d3c3e04918bfab9d7d6cbc6e50602ab2bdfe1365314570943346a71a00",
         )
 
     @responses.activate