repoze/repoze.who-sqlalchemy — pull request #3 by arturosevilla (2011-11-13 12:06:03+00:00)
Title: This plugin may be vulnerable to timing attacks.

For example, if I'm using bcrypt as my hash generator, an attacker may notice that he may discover usernames when the login fails more slowly than for non-existing usernames. This is due to the following part:
if user:
validator = getattr(user, self.translations['validate_password'])
if validator(identity['password']):
return identity['login']

In file repoze/who/plugins/sa.py line 167

If the user does not exist then validator never gets executed.

In the attached commit I've included my proposed solution (with unit tests). Notice that because I've introduced a new "translation" called dummy_validate. While I would have preferred that "validate_password" should have been changed to be a function instead of a method (so that we can call it when user is None), this would a break a lot of existing software.