b2c69e2 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

feat: update HashNonce to use crypto/sha256 (#2967)

b2c69e2Evan Gibler2 years ago

CHANGELOG.md+1

@@ -36,6 +36,7 @@

36- [#2977](https://github.com/oauth2-proxy/oauth2-proxy/pull/2977) Update golang.org/x/net to v0.36.0 to address CVE-2025-22870 (@dsymonds)

37- [#2982](https://github.com/oauth2-proxy/oauth2-proxy/pull/2982) chore(deps): remove go:generate tool from go.mod (@dolmen)

38- [#3011](https://github.com/oauth2-proxy/oauth2-proxy/pull/3011) chore(deps): update golang dependencies and pin to latest golang v1.23.x release (@tuunit)

39+- [#2967](https://github.com/oauth2-proxy/oauth2-proxy/pull/2967) Update HashNonce to use crypto/sha256 (@egibs)

40# V7.8.1

41# V7.8.1

pkg/encryption/nonce.go+8−9

@@ -3,9 +3,8 @@ package encryption

3import (

4 "crypto/hmac"

5 "crypto/rand"

6+ "crypto/sha256"

6 "encoding/base64"

7 "encoding/base64"

7−

8− "golang.org/x/crypto/blake2b"

11// Nonce generates a random n-byte slice

10// Nonce generates a random n-byte slice

@@ -18,16 +17,16 @@ func Nonce(length int) ([]byte, error) {

18 return b, nil

17 return b, nil

19}

18}

21−// HashNonce returns the BLAKE2b 256-bit hash of a nonce

20+// HashNonce returns the SHA256 hash of a nonce

22−// NOTE: Error checking (G104) is purposefully skipped:

23−// - `blake2b.New256` has no error path with a nil signing key

24−// - `hash.Hash` interface's `Write` has an error signature, but

25−// `blake2b.digest.Write` does not use it.

26−/* #nosec G104 */

27func HashNonce(nonce []byte) string {

21func HashNonce(nonce []byte) string {

28− hasher, _ := blake2b.New256(nil)

22+ if nonce == nil {

23+ return ""

24+ }

25+

26+ hasher := sha256.New()

29 hasher.Write(nonce)

27 hasher.Write(nonce)

30 sum := hasher.Sum(nil)

28 sum := hasher.Sum(nil)

29+

31 return base64.RawURLEncoding.EncodeToString(sum)

30 return base64.RawURLEncoding.EncodeToString(sum)

32}

31}