Skip to content

Commit 835cf4c

Browse files
zeripathzeripath
committed
WebAuthn CredentialID field needs to be increased in size
WebAuthn have updated their specification to set the maximum size of the CredentialID to 1023 bytes. This is somewhat larger than our current size and therefore we need to migrate. Fix go-gitea#20457 Signed-off-by: Andrew Thornton <[email protected]>
1 parent c9c5bd8 commit 835cf4c

File tree

5 files changed

+84
-7
lines changed

5 files changed

+84
-7
lines changed

‎models/auth/webauthn.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ type WebAuthnCredential struct {
4343
Name string
4444
LowerName string `xorm:"unique(s)"`
4545
UserID int64 `xorm:"INDEX unique(s)"`
46-
CredentialID string `xorm:"INDEX VARCHAR(410)"`
46+
CredentialID string `xorm:"INDEX VARCHAR(1640)"`
4747
PublicKey []byte
4848
AttestationType string
4949
AAGUID []byte

‎models/migrations/migrations.go

+2
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,8 @@ var migrations = []Migration{
400400
NewMigration("Add sync_on_commit column to push_mirror table", addSyncOnCommitColForPushMirror),
401401
// v220 -> v221
402402
NewMigration("Add container repository property", addContainerRepositoryProperty),
403+
// v221 -> v222
404+
NewMigration("Increase WebAuthentication CredentialID size to 1640", increaseCredentialIDTo1640),
403405
}
404406

405407
// GetCurrentDBVersion returns the current db version

‎models/migrations/v210.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ func remigrateU2FCredentials(x *xorm.Engine) error {
2525
Name string
2626
LowerName string `xorm:"unique(s)"`
2727
UserID int64 `xorm:"INDEX unique(s)"`
28-
CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety
28+
CredentialID string `xorm:"INDEX VARCHAR(1640)"` // CredentialID is at most 1023 bytes as per spec released 20 July 2022 -> 1640 base32 encoding
2929
PublicKey []byte
3030
AttestationType string
3131
AAGUID []byte
@@ -40,12 +40,12 @@ func remigrateU2FCredentials(x *xorm.Engine) error {
4040

4141
switch x.Dialect().URI().DBType {
4242
case schemas.MYSQL:
43-
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(410)")
43+
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(1640)")
4444
if err != nil {
4545
return err
4646
}
4747
case schemas.ORACLE:
48-
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(410)")
48+
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(1640)")
4949
if err != nil {
5050
return err
5151
}
@@ -70,7 +70,7 @@ func remigrateU2FCredentials(x *xorm.Engine) error {
7070
return err
7171
}
7272
case schemas.POSTGRES:
73-
_, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(410)")
73+
_, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(1640)")
7474
if err != nil {
7575
return err
7676
}

‎models/migrations/v210_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ func Test_remigrateU2FCredentials(t *testing.T) {
2020
Name string
2121
LowerName string `xorm:"unique(s)"`
2222
UserID int64 `xorm:"INDEX unique(s)"`
23-
CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety
23+
CredentialID string `xorm:"INDEX VARCHAR(1640)"` // CredentialID is at most 1023 bytes as per spec released 20 July 2022 -> 1640 base32 encoding
2424
PublicKey []byte
2525
AttestationType string
2626
SignCount uint32 `xorm:"BIGINT"`
@@ -40,7 +40,7 @@ func Test_remigrateU2FCredentials(t *testing.T) {
4040

4141
type ExpectedWebauthnCredential struct {
4242
ID int64 `xorm:"pk autoincr"`
43-
CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety
43+
CredentialID string `xorm:"INDEX VARCHAR(1640)"` // CredentialID is at most 1023 bytes as per spec released 20 July 2022 -> 1640 base32 encoding
4444
}
4545

4646
// Prepare and load the testing database

‎models/migrations/v221.go

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Copyright 2022 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package migrations
6+
7+
import (
8+
"code.gitea.io/gitea/modules/timeutil"
9+
10+
"xorm.io/xorm"
11+
"xorm.io/xorm/schemas"
12+
)
13+
14+
func increaseCredentialIDTo1640(x *xorm.Engine) error {
15+
// Create webauthnCredential table
16+
type webauthnCredential struct {
17+
ID int64 `xorm:"pk autoincr"`
18+
Name string
19+
LowerName string `xorm:"unique(s)"`
20+
UserID int64 `xorm:"INDEX unique(s)"`
21+
CredentialID string `xorm:"INDEX VARCHAR(1640)"` // CredentialID is at most 1023 bytes as per spec released 20 July 2022 -> 1640 base32 encoding
22+
PublicKey []byte
23+
AttestationType string
24+
AAGUID []byte
25+
SignCount uint32 `xorm:"BIGINT"`
26+
CloneWarning bool
27+
CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
28+
UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
29+
}
30+
if err := x.Sync2(&webauthnCredential{}); err != nil {
31+
return err
32+
}
33+
34+
switch x.Dialect().URI().DBType {
35+
case schemas.MYSQL:
36+
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(1640)")
37+
if err != nil {
38+
return err
39+
}
40+
case schemas.ORACLE:
41+
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(1640)")
42+
if err != nil {
43+
return err
44+
}
45+
case schemas.MSSQL:
46+
// This column has an index on it. I could write all of the code to attempt to change the index OR
47+
// I could just use recreate table.
48+
sess := x.NewSession()
49+
if err := sess.Begin(); err != nil {
50+
_ = sess.Close()
51+
return err
52+
}
53+
54+
if err := recreateTable(sess, new(webauthnCredential)); err != nil {
55+
_ = sess.Close()
56+
return err
57+
}
58+
if err := sess.Commit(); err != nil {
59+
_ = sess.Close()
60+
return err
61+
}
62+
if err := sess.Close(); err != nil {
63+
return err
64+
}
65+
case schemas.POSTGRES:
66+
_, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(1640)")
67+
if err != nil {
68+
return err
69+
}
70+
default:
71+
// SQLite doesn't support ALTER COLUMN, and it already makes String _TEXT_ by default so no migration needed
72+
// nor is there any need to re-migrate
73+
}
74+
return nil
75+
}

0 commit comments

Comments
 (0)