c2e25edbf8c48361a71398664ec0c279d5fc58f5 braney Sat Sep 19 18:11:31 2026 -0700 hmacTest: pin the signature hgLogin puts on a pending social identity hgLogin signs a pending social identity with hmacMd5(login.cookieSalt, fields) and hands the signature to the browser in the account chooser, so a forgeable signature lets an attacker choose whose account the chooser links to. Nothing about the page looks different either way. Before #37984 that signature was a plain MD5 of the salt concatenated in front of the same fields, and a hash of a secret followed by attacker-chosen text is the wrong shape for the job. boundaryMoves() is the case that says so: with concatenation, hmacMd5("a", "bc") and hmacMd5("ab", "c") hash the same bytes and sign the same, while HMAC keeps them apart. Known answers are RFC 2202 test case 2 for MD5 and SHA1, cross-checked here with the openssl command line. Only the string-keyed vectors from the RFC can be used, since this interface takes key and data as C strings. Watched to fail and then pass: putting hmacMd5 back to the concatenation shape turns the known answer red and makes the two boundary cases identical, both of which the test catches. Recorded as sandbox-ab in utils/testRegistry. refs #37984, refs #38391 diff --git src/utils/testRegistry/registry.tsv src/utils/testRegistry/registry.tsv index ea3bcdb74a2..dc474afdb78 100644 --- src/utils/testRegistry/registry.tsv +++ src/utils/testRegistry/registry.tsv @@ -42,31 +42,31 @@ # down, which is the first thing the person who writes it needs. # # One ticket can have several rows and one test can defend several tickets; both happen # here already. A ticket cannot be both covered and waiting. # # `testRegistry check` reads every row and fails when one has rotted, so a test cannot be # renamed or deleted without coming here. # #ticket release test docent why evidence note 10138 504 - rm10138.docent.yaml invisible - needs one: the session data directory hash went from 8 to 10 hex characters 20824 504 hg/utils/netToBigNet/tests/makefile::simpleTest - library unrecorded a net converted to bigNet and back, byte compared 27988 504 - - invisible - needs one: a server that is not the node hg.conf names has to recognise itself 36212 504 - rm36212.docent.yaml library - needs one: an explicit itemRgb on has to beat the presence of a color setting 37263 504 lib/tests/pathSimplifyTest.c - library unrecorded dot-dot collapsing, checked against the right answer rather than against the old one 37969 504 - rm37969.docent.yaml library - needs one: a quickLifted container must not hide the tracks inside it -37984 504 - - library - needs one: lib/hmac.c is new and has no test of its own +37984 504 lib/tests/hmacTest.c - library sandbox-ab the pending social identity is signed with hmacMd5, not a plain md5 of salt plus fields 38086 504 - - invisible - needs one: a stale cart visibility variable must not hide a new BLAT result track 38126 504 lib/tests/htmlSanitizeTest.c rm38126.docent.yaml library unrecorded the allowlist that hub and custom track description HTML is filtered through 38184 504 - rm38184.docent.yaml invisible - needs one: db= resolving to the assembly already loaded must keep the session position 38185 504 hg/hgSession/tests/backupParseTest.c rm38185.docent.yaml invisible unrecorded an empty pair in a session backup must not eat the variable in front of it 38185 504 lib/tests/cgiParseTest.c rm38185.docent.yaml invisible unrecorded an empty CGI pair must not abort the request 38198 504 - rm38198.docent.yaml library - needs one: a second lift has to update a track already in the hub 38225 504 - - perf - needs one: the malloc step size now comes from hg.conf; the test has to read the knob back and see it applied 38233 504 - - perf - needs one: RefSeq status is asked once per track, not once per gene; the test has to count the queries, not the seconds 38236 504 - rm38236.docent.yaml library - needs one: a quickLift chain with no aligned block in the window must not crash 38248 504 - rm38248.docent.yaml library - needs one: a deprecated versioned NP_ accession has to resolve to RefSeq Historical 38249 504 hg/lib/tests/quickLiftTester.c rm38249.docent.yaml library unrecorded the target strand of a reverse complemented protein, found in the #38349 review 38253 504 - - perf - needs one: item coverage is built from feature runs, not one counter per base; the test has to go red if a per-base pass comes back 38254 504 - - invisible - needs one: a composite subtrack's visibility has to settle before the parallel loaders start 38256 504 hg/utils/hubCheck/tests/makefile::relPath - library unrecorded a local hub given by a relative path: bigDataUrl resolved once, not twice 38260 504 hg/utils/hubCheck/tests/makefile::missingFile - library unrecorded hubCheck must say something about a bigDataUrl it cannot open