Page MenuHomePhabricator

Use "%P" to protect session key hashes in SessionEngine queries from DarkConsole
ClosedPublic

Authored by epriestley on Nov 15 2018, 1:31 PM.
Tags
None
Referenced Files
F13048574: D19812.diff
Thu, Apr 18, 9:10 PM
Unknown Object (File)
Thu, Apr 18, 8:47 AM
Unknown Object (File)
Thu, Apr 18, 4:51 AM
Unknown Object (File)
Tue, Apr 16, 6:51 PM
Unknown Object (File)
Sat, Apr 13, 12:21 PM
Unknown Object (File)
Sat, Apr 13, 12:21 PM
Unknown Object (File)
Fri, Apr 12, 9:10 PM
Unknown Object (File)
Thu, Apr 11, 9:10 AM
Subscribers
None

Details

Summary

Ref T6960. Ref T13217. Ref T13216. Depends on D19811. Use the recently-introduced "%P" conversion ("Password/Secret") to load sessions in SessionEngine.

This secret isn't critical to protect (it's the hash of the actual secret and not useful to attackers on its own) but it shows up on every page in DarkConsole and is an obvious case where %P is a more appropriate conversion.

Test Plan

Note "*****" in the middle of the output here, instead of a session key hash:

Screen Shot 2018-11-15 at 5.28.57 AM.png (333×1 px, 102 KB)

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable