repoze/repoze.who-sqlalchemy — Issue #2: This plugin may be vulnerable to timing attacks.
Author: arturosevilla
Created: 2011-11-13 12:00:06+00:00
State: open

For example, if I'm using bcrypt as my hash generator, an attacker may notice that he may discover usernames when the login fails more slowly than for non-existing usernames. This is due to the following part:
if user:
validator = getattr(user, self.translations['validate_password'])
if validator(identity['password']):
return identity['login']

In file repoze/who/plugins/sa.py line 167

If the user does not exist then validator never gets executed.

In the attached commit I've included my proposed solution (with unit tests). Notice that because I've introduced a new "translation" called dummy_validate. While I would have preferred that "validate_password" should have been changed to be a function instead of a method (so that we can call it when user is None), this would a break a lot of existing software.