summaryrefslogtreecommitdiffstats
path: root/models/user_test.go
diff options
context:
space:
mode:
Diffstat (limited to 'models/user_test.go')
-rw-r--r--models/user_test.go39
1 files changed, 39 insertions, 0 deletions
diff --git a/models/user_test.go b/models/user_test.go
index 03ab54aaf7..c0b7dace7f 100644
--- a/models/user_test.go
+++ b/models/user_test.go
@@ -5,6 +5,7 @@
package models
import (
+ "math/rand"
"testing"
"code.gitea.io/gitea/modules/setting"
@@ -123,3 +124,41 @@ func TestDeleteUser(t *testing.T) {
test(8)
test(11)
}
+
+func TestHashPasswordDeterministic(t *testing.T) {
+ b := make([]byte, 16)
+ rand.Read(b)
+ u := &User{Salt: string(b)}
+ for i := 0; i < 50; i++ {
+ // generate a random password
+ rand.Read(b)
+ pass := string(b)
+
+ // save the current password in the user - hash it and store the result
+ u.Passwd = pass
+ u.HashPassword()
+ r1 := u.Passwd
+
+ // run again
+ u.Passwd = pass
+ u.HashPassword()
+ r2 := u.Passwd
+
+ // assert equal (given the same salt+pass, the same result is produced)
+ assert.Equal(t, r1, r2)
+ }
+}
+
+func BenchmarkHashPassword(b *testing.B) {
+ // BenchmarkHashPassword ensures that it takes a reasonable amount of time
+ // to hash a password - in order to protect from brute-force attacks.
+ pass := "password1337"
+ bs := make([]byte, 16)
+ rand.Read(bs)
+ u := &User{Salt: string(bs), Passwd: pass}
+ b.ResetTimer()
+ for i := 0; i < b.N; i++ {
+ u.HashPassword()
+ u.Passwd = pass
+ }
+}