- Modified login to prevent timing attacks.

- Sanity checks now support tests_right and tests_wrong in questions (unit testing for questions) - Application name is defined in __init__.py only, so that changing name becomes easier.

- Modified login to prevent timing attacks.
- Sanity checks now support tests_right and tests_wrong in questions (unit testing for questions) - Application name is defined in __init__.py only, so that changing name becomes easier.
Miguel Barão
1 parent 5dae401a
Showing 13 changed files with 97 additions and 69 deletions Show diff stats
aprendizations/initdb.py
aprendizations/knowledge.py
aprendizations/learnapp.py
aprendizations/models.py
aprendizations/questions.py
aprendizations/redirect.py
aprendizations/serve.py
aprendizations/templates/login.html
aprendizations/templates/maintopics-table.html
aprendizations/templates/rankings.html
aprendizations/templates/topic.html
aprendizations/tools.py
package.json
 #!/usr/bin/env python3
-# base
+# python standard libraries
 import csv
 import argparse
 import re
 from string import capwords
 from concurrent.futures import ThreadPoolExecutor
-# installed packages
+# third party libraries
 import bcrypt
 import sqlalchemy as sa
 # this project
-from aprendizations.models import Base, Student
+from .models import Base, Student
 # ===========================================================================
@@ -5,12 +5,9 @@ from datetime import datetime
 import logging
 import asyncio
-# libraries
+# third party libraries
 import networkx as nx
-# this project
-# import questions
-
 # setup logger for this module
 logger = logging.getLogger(__name__)
@@ -5,41 +5,25 @@ import logging
 from contextlib import contextmanager  # `with` statement in db sessions
 import asyncio
 from datetime import datetime
+from random import random
-# user installed libraries
+# third party libraries
 import bcrypt
 from sqlalchemy import create_engine, func
 from sqlalchemy.orm import sessionmaker
 import networkx as nx
 # this project
-from aprendizations.models import Student, Answer, Topic, StudentTopic
-from aprendizations.knowledge import StudentKnowledge
-from aprendizations.questions import QFactory
-from aprendizations.tools import load_yaml
+from .models import Student, Answer, Topic, StudentTopic
+from .knowledge import StudentKnowledge
+from .questions import QFactory
+from .tools import load_yaml
 # setup logger for this module
 logger = logging.getLogger(__name__)
 # ============================================================================
-# helper functions
-# ============================================================================
-async def _bcrypt_hash(a, b):
-    loop = asyncio.get_running_loop()
-    return await loop.run_in_executor(None, bcrypt.hashpw,
-                                      a.encode('utf-8'), b)
-
-
-async def check_password(try_pw: str, pw: str) -> bool:
-    return pw == await _bcrypt_hash(try_pw, pw)
-
-
-async def bcrypt_hash_gen(new_pw: str):
-    return await _bcrypt_hash(new_pw, bcrypt.gensalt())
-
-
-# ============================================================================
 class LearnException(Exception):
     pass
@@ -86,38 +70,74 @@ class LearnApp(object):
     # ------------------------------------------------------------------------
     def sanity_check_questions(self):
-        def check_question(qref, q):
-            logger.debug(f'Generating {qref}...')
-            try:
-                q.generate()
-            except Exception as e:
-                logger.error(f'Sanity check failed in "{qref}"')
-                raise e
+        logger.info('Starting sanity checks (may take a while...)')
-        logger.info('Starting sanity checks...')
-        for qref, q in self.factory.items():
-            check_question(qref, q)
-        logger.info('Sanity checks passed.')
+        errors = 0
+        for qref in self.factory:
+            logger.debug(f'Checking "{qref}"...')
+            q = self.factory[qref].generate()
+            try:
+                q = self.factory[qref].generate()
+            except Exception:
+                logger.error(f'Failed to generate "{qref}".')
+                errors += 1
+                raise
+                continue
+
+            if 'tests_right' in q:
+                for t in q['tests_right']:
+                    q['answer'] = t
+                    q.correct()
+                    if q['grade'] < 1.0:
+                        logger.error(f'Failed to correct right answer in '
+                                     f'"{qref}".')
+                        errors += 1
+                        continue  # to next right test
+
+            if 'tests_wrong' in q:
+                for t in q['tests_wrong']:
+                    q['answer'] = t
+                    q.correct()
+                    if q['grade'] >= 1.0:
+                        logger.error(f'Failed to correct right answer in '
+                                     f'"{qref}".')
+                        errors += 1
+                        continue  # to next wrong test
+
+        if errors > 0:
+            logger.info(f'{errors:>6} errors found.')
+            raise
+        else:
+            logger.info('No errors found.')
     # ------------------------------------------------------------------------
     # login
     # ------------------------------------------------------------------------
-    async def login(self, uid, try_pw):
+    async def login(self, uid, pw):
         with self.db_session() as s:
-            try:
-                name, password = s.query(Student.name, Student.password) \
-                                 .filter_by(id=uid) \
-                                 .one()
-            except Exception:
-                logger.info(f'User "{uid}" does not exist')
-                return False
+            found = s.query(Student.name, Student.password) \
+                     .filter_by(id=uid) \
+                     .one_or_none()
+
+        # wait random time to minimize timing attacks
+        await asyncio.sleep(random())
+
+        loop = asyncio.get_running_loop()
+        if found is None:
+            logger.info(f'User "{uid}" does not exist')
+            await loop.run_in_executor(None, bcrypt.hashpw, b'',
+                                       bcrypt.gensalt())  # just spend time
+            return False
-        pw_ok = await check_password(try_pw, password)  # async bcrypt
+        else:
+            name, hashed_pw = found
+            pw_ok = await loop.run_in_executor(None, bcrypt.checkpw,
+                                               pw.encode('utf-8'), hashed_pw)
         if pw_ok:
             if uid in self.online:
-                logger.warning(f'User "{uid}" already logged in, overwriting')
-                counter = self.online[uid]['counter']  # simultaneous logins
+                logger.warning(f'User "{uid}" already logged in')
+                counter = self.online[uid]['counter']
             else:
                 logger.info(f'User "{uid}" logged in')
                 counter = 0
@@ -158,7 +178,9 @@ class LearnApp(object):
         if not pw:
             return False
-        pw = await bcrypt_hash_gen(pw)
+        loop = asyncio.get_running_loop()
+        pw = await loop.run_in_executor(None, bcrypt.hashpw,
+                                        pw.encode('utf-8'), bcrypt.gensalt())
         with self.db_session() as s:
             u = s.query(Student).get(uid)
+# third party libraries
 from sqlalchemy import Column, ForeignKey, Integer, Float, String
 from sqlalchemy.ext.declarative import declarative_base
 from sqlalchemy.orm import relationship
@@ -7,7 +7,7 @@ import logging
 import asyncio
 # this project
-from aprendizations.tools import run_script
+from .tools import run_script
 # setup logger for this module
 logger = logging.getLogger(__name__)
 #!/usr/bin/env python3
+# python standard libraries
+import argparse
+
+# third party libraries
 from tornado.web import RedirectHandler, Application
 from tornado.ioloop import IOLoop
-import argparse
 def main():
@@ -14,16 +14,16 @@ import functools
 import ssl
 import asyncio
-# user installed libraries
+# third party libraries
 import tornado.ioloop
 import tornado.web
 import tornado.httpserver
 from tornado.escape import to_unicode
 # this project
-from aprendizations.learnapp import LearnApp
-from aprendizations.tools import load_yaml, md_to_html
-from aprendizations import APP_NAME
+from .learnapp import LearnApp
+from .tools import load_yaml, md_to_html
+from . import APP_NAME
 # ----------------------------------------------------------------------------
@@ -97,6 +97,7 @@ class RankingsHandler(BaseHandler):
         uid = self.current_user
         rankings = self.learn.get_rankings(uid)
         self.render('rankings.html',
+                    appname=APP_NAME,
                     uid=uid,
                     name=self.learn.get_student_name(uid),
                     rankings=rankings)
@@ -107,7 +108,9 @@ class RankingsHandler(BaseHandler):
 # ----------------------------------------------------------------------------
 class LoginHandler(BaseHandler):
     def get(self):
-        self.render('login.html', error='')
+        self.render('login.html',
+                    appname=APP_NAME,
+                    error='')
     async def post(self):
         uid = self.get_body_argument('uid').lstrip('l')
@@ -121,7 +124,9 @@ class LoginHandler(BaseHandler):
             self.set_secure_cookie('counter', counter)
             self.redirect('/')
         else:
-            self.render('login.html', error='Número ou senha incorrectos')
+            self.render('login.html',
+                        appname=APP_NAME,
+                        error='Número ou senha incorrectos')
 # ----------------------------------------------------------------------------
@@ -168,6 +173,7 @@ class RootHandler(BaseHandler):
     def get(self):
         uid = self.current_user
         self.render('maintopics-table.html',
+                    appname=APP_NAME,
                     uid=uid,
                     name=self.learn.get_student_name(uid),
                     state=self.learn.get_student_state(uid),
@@ -193,6 +199,7 @@ class TopicHandler(BaseHandler):
             self.redirect('/')
         else:
             self.render('topic.html',
+                        appname=APP_NAME,
                         uid=uid,
                         name=self.learn.get_student_name(uid),
                         )
@@ -201,9 +208,6 @@ class TopicHandler(BaseHandler):
 # ----------------------------------------------------------------------------
 # Serves files from the /public subdir of the topics.
 # ----------------------------------------------------------------------------
-
-# FIXME error in many situations... images are not shown...
-# seems to happen when the browser sends two GET requests at the same time
 class FileHandler(BaseHandler):
     SUPPORTED_METHODS = ['GET']
 <!DOCTYPE html>
 <html lang="en">
 <head>
-  <title>iLearn</title>
+  <title>{{appname}}</title>
   <link rel="icon" href="/static/favicon.ico">
   <meta charset="utf-8">
@@ -3,7 +3,7 @@
 <!doctype html>
 <html lang="pt-PT">
 <head>
-  <title>iLearn</title>
+  <title>{{appname}}</title>
   <link rel="icon" href="/static/favicon.ico">
   <meta charset="utf-8">
@@ -3,7 +3,7 @@
 <!doctype html>
 <html lang="pt-PT">
 <head>
-  <title>iLearn</title>
+  <title>{{appname}}</title>
   <link rel="icon" href="/static/favicon.ico">
   <meta charset="utf-8">
 <!DOCTYPE html>
 <html>
 <head>
-    <title>iLearn</title>
+    <title>{{appname}}</title>
     <link rel="icon" href="/static/favicon.ico">
     <meta charset="utf-8">
@@ -5,7 +5,7 @@ import subprocess
 import logging
 import re
-# user installed libraries
+# third party libraries
 import yaml
 import mistune
 from pygments import highlight
@@ -6,5 +6,6 @@
         "codemirror": "^5.45.0",
         "mathjax": "^2.7.5",
         "mdbootstrap": "^4.7.6"
-    }
+    },
+    "private": true
 }
1	#!/usr/bin/env python3	1	#!/usr/bin/env python3
2		2
3	-# base	3	+# python standard libraries
4	import csv	4	import csv
5	import argparse	5	import argparse
6	import re	6	import re
7	from string import capwords	7	from string import capwords
8	from concurrent.futures import ThreadPoolExecutor	8	from concurrent.futures import ThreadPoolExecutor
9		9
10	-# installed packages	10	+# third party libraries
11	import bcrypt	11	import bcrypt
12	import sqlalchemy as sa	12	import sqlalchemy as sa
13		13
14	# this project	14	# this project
15	-from aprendizations.models import Base, Student	15	+from .models import Base, Student
16		16
17		17
18	# ===========================================================================	18	# ===========================================================================
1		1
		2	+# third party libraries
2	from sqlalchemy import Column, ForeignKey, Integer, Float, String	3	from sqlalchemy import Column, ForeignKey, Integer, Float, String
3	from sqlalchemy.ext.declarative import declarative_base	4	from sqlalchemy.ext.declarative import declarative_base
4	from sqlalchemy.orm import relationship	5	from sqlalchemy.orm import relationship
	@@ -7,7 +7,7 @@ import logging		@@ -7,7 +7,7 @@ import logging
7	import asyncio	7	import asyncio
8		8
9	# this project	9	# this project
10	-from aprendizations.tools import run_script	10	+from .tools import run_script
11		11
12	# setup logger for this module	12	# setup logger for this module
13	logger = logging.getLogger(__name__)	13	logger = logging.getLogger(__name__)
1	<!DOCTYPE html>	1	<!DOCTYPE html>
2	<html lang="en">	2	<html lang="en">
3	<head>	3	<head>
4	- <title>iLearn</title>	4	+ <title>{{appname}}</title>
5	<link rel="icon" href="/static/favicon.ico">	5	<link rel="icon" href="/static/favicon.ico">
6		6
7	<meta charset="utf-8">	7	<meta charset="utf-8">
	@@ -3,7 +3,7 @@		@@ -3,7 +3,7 @@
3	<!doctype html>	3	<!doctype html>
4	<html lang="pt-PT">	4	<html lang="pt-PT">
5	<head>	5	<head>
6	- <title>iLearn</title>	6	+ <title>{{appname}}</title>
7	<link rel="icon" href="/static/favicon.ico">	7	<link rel="icon" href="/static/favicon.ico">
8		8
9	<meta charset="utf-8">	9	<meta charset="utf-8">
1	<!DOCTYPE html>	1	<!DOCTYPE html>
2	<html>	2	<html>
3	<head>	3	<head>
4	- <title>iLearn</title>	4	+ <title>{{appname}}</title>
5	<link rel="icon" href="/static/favicon.ico">	5	<link rel="icon" href="/static/favicon.ico">
6		6
7	<meta charset="utf-8">	7	<meta charset="utf-8">
	@@ -5,7 +5,7 @@ import subprocess		@@ -5,7 +5,7 @@ import subprocess
5	import logging	5	import logging
6	import re	6	import re
7		7
8	-# user installed libraries	8	+# third party libraries
9	import yaml	9	import yaml
10	import mistune	10	import mistune
11	from pygments import highlight	11	from pygments import highlight
	@@ -6,5 +6,6 @@		@@ -6,5 +6,6 @@
6	"codemirror": "^5.45.0",	6	"codemirror": "^5.45.0",
7	"mathjax": "^2.7.5",	7	"mathjax": "^2.7.5",
8	"mdbootstrap": "^4.7.6"	8	"mdbootstrap": "^4.7.6"
9	- }	9	+ },
		10	+ "private": true
10	}	11	}