Skip to content

Commit d44b3ae

Browse files
Fabinatix97Fabinatix97
committed
Use base payload for challenge verification
1 parent a6f8b1d commit d44b3ae

File tree

4 files changed

+21
-11
lines changed

4 files changed

+21
-11
lines changed

‎captchaservice-backend/src/main/java/de/muenchen/captchaservice/controller/captcha/request/PostVerifyRequest.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,13 @@
11
package de.muenchen.captchaservice.controller.captcha.request;
22

3+
import de.muenchen.captchaservice.data.ExtendedPayload;
34
import de.muenchen.captchaservice.validation.ValidSourceAddress;
45
import jakarta.validation.constraints.NotBlank;
56
import jakarta.validation.constraints.NotNull;
67
import lombok.AllArgsConstructor;
78
import lombok.Data;
89
import lombok.NoArgsConstructor;
910

10-
import de.muenchen.captchaservice.data.ExtendedPayload;
11-
1211
@Data
1312
@NoArgsConstructor
1413
@AllArgsConstructor

‎captchaservice-backend/src/main/java/de/muenchen/captchaservice/data/ExtendedPayload.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,14 @@ public class ExtendedPayload extends Altcha.Payload {
1414
*/
1515
private Long took;
1616

17+
public Altcha.Payload toBasePayload() {
18+
Altcha.Payload base = new Altcha.Payload();
19+
base.algorithm = this.algorithm;
20+
base.challenge = this.challenge;
21+
base.number = this.number;
22+
base.salt = this.salt;
23+
base.signature = this.signature;
24+
return base;
25+
}
26+
1727
}

‎captchaservice-backend/src/main/java/de/muenchen/captchaservice/service/captcha/CaptchaService.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,8 @@ public boolean verify(final String siteKey, final ExtendedPayload payload, final
5757
return false;
5858
}
5959
try {
60-
final boolean isValid = Altcha.verifySolution(payload, captchaProperties.hmacKey(), false);
60+
Altcha.Payload base = payload.toBasePayload();
61+
final boolean isValid = Altcha.verifySolution(base, captchaProperties.hmacKey(), true);
6162
log.info("Altcha.verifySolution() returned {} for payloadHash={}", isValid, getPayloadHash(payload));
6263
if (isValid) {
6364
log.info("Sucessfully verified. Recording success for metrics...");

‎captchaservice-backend/src/test/java/de/muenchen/captchaservice/controller/captcha/CaptchaControllerTest.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ void postVerify_success() {
183183
final String requestBody = objectMapper.writeValueAsString(request);
184184
try (MockedStatic<Altcha> mock = Mockito.mockStatic(Altcha.class)) {
185185
mock
186-
.when(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(false)))
186+
.when(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(true)))
187187
.thenReturn(true);
188188
// --
189189
mockMvc.perform(
@@ -194,7 +194,7 @@ void postVerify_success() {
194194
.andExpect(content().contentType(MediaType.APPLICATION_JSON))
195195
.andExpect(jsonPath("$.valid", is(true)));
196196
// --
197-
mock.verify(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(false)));
197+
mock.verify(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(true)));
198198
} catch (Exception e) {
199199
fail(e.getMessage());
200200
}
@@ -222,7 +222,7 @@ void postVerify_expired() {
222222
try (MockedStatic<Altcha> mock = Mockito.mockStatic(Altcha.class)) {
223223
// Successful request
224224
mock
225-
.when(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(false)))
225+
.when(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(true)))
226226
.thenReturn(true);
227227
mockMvc.perform(
228228
post("/api/v1/captcha/verify")
@@ -231,11 +231,11 @@ void postVerify_expired() {
231231
.andExpect(status().isOk())
232232
.andExpect(content().contentType(MediaType.APPLICATION_JSON))
233233
.andExpect(jsonPath("$.valid", is(true)));
234-
mock.verify(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(false)));
234+
mock.verify(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(true)));
235235

236236
// Expired request
237237
mock
238-
.when(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(false)))
238+
.when(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(true)))
239239
.thenReturn(true);
240240
mockMvc.perform(
241241
post("/api/v1/captcha/verify")
@@ -244,7 +244,7 @@ void postVerify_expired() {
244244
.andExpect(status().isOk())
245245
.andExpect(content().contentType(MediaType.APPLICATION_JSON))
246246
.andExpect(jsonPath("$.valid", is(false)));
247-
mock.verify(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(false)));
247+
mock.verify(() -> Altcha.verifySolution(ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()), eq(TEST_HMAC_KEY), eq(true)));
248248
} catch (Exception e) {
249249
fail(e.getMessage());
250250
}
@@ -286,7 +286,7 @@ void testVerifyMetricsIncrement() {
286286
mock.when(() -> Altcha.verifySolution(
287287
ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()),
288288
eq(TEST_HMAC_KEY),
289-
eq(false)))
289+
eq(true)))
290290
.thenReturn(true);
291291

292292
for (int i = 1; i <= calls; i++) {
@@ -328,7 +328,7 @@ void testInvalidatedPayloadsGauge() {
328328
mock.when(() -> Altcha.verifySolution(
329329
ArgumentMatchers.<Altcha.Payload>argThat(p -> p.algorithm.isEmpty()),
330330
eq(TEST_HMAC_KEY),
331-
eq(false)))
331+
eq(true)))
332332
.thenReturn(true);
333333

334334
mockMvc.perform(post("/api/v1/captcha/verify")

0 commit comments

Comments
 (0)