提升admin密码变更和OIDC客户端密钥的bcrypt哈希成本至12 - #16
Open
saaa99999999 wants to merge 1 commit into
Open
saaa99999999 wants to merge 1 commit into
saaa99999999 wants to merge 1 commit into
Conversation
admin密码变更(ChangePassword)和OIDC客户端密钥生成(generateClientSecret) 使用了bcrypt.DefaultCost(成本10)，而项目中其他地方(用户密码、admin初始密码) 统一使用成本12。根据项目SECURITY.md声明和OWASP建议，统一提升至成本12。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Author
CVE Request — Action Needed from MaintainerThis PR fixes security vulnerabilities. To assign a CVE number: GitHub only issues CVEs from the official upstream repository, not from forks. Please:
If you prefer, I can submit the CVE via MITRE (cveform.mitre.org) instead — just let me know. Thank you for reviewing this PR! |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
在审计代码时发现， 包中的密码变更()和 包中的客户端密钥生成()使用了 (成本=10)，而项目中其他所有密码哈希操作(user注册/密码重置/admin初始设置)统一使用成本12。
受影响位置
影响
Admin 账户拥有管理后台的完整访问权限(租户/应用/用户/RBAC 管理)，其密码被以低于项目标准的成本进行哈希。根据项目 SECURITY.md 声明("bcrypt with cost factor 12")和 OWASP 建议，应该统一使用成本12。
值得注意的是：
修复
将两处 替换为 ，与项目中其他 bcrypt 调用保持一致。