{"header":{"message":"replace blake2 with blake3. I think node being a wrapper around openSSL makes it slow. 481,000ops/s vs 1,970,000ops/s\ndecrease token length and hash length to 128bits(argon2 waiting for pr to land: https://github.com/ranisalt/node-argon2/pull/266)\nhttps://security.stackexchange.com/questions/102157/do-you-need-more-than-128-bit-entropy \"128 bits of entropy are enough. if you generate a 256-bit AES key from a 128-bit seed and a strong PRNG, then you do not really have a 256-bit key.\"\nhttps://crypto.stackexchange.com/a/29618 \"if you had random binary tokens, a token longer than [hash function digest length]bits would be useless.\"\nhex encode instead of base64\nthere exists a timing attack via dictionary reduction on hash prefix discovery\ntherefore, not applicable to lobomj. password hashes are salted(if the salt is known, so is the hash) and tokens are of sufficient entropy to make brute force/dictionary infeasible.\nhttps://github.com/codahale/bcrypt-ruby/pull/43#issuecomment-15797932\nhttps://github.com/aj-code/TimingIntrusionTool5000/blob/master/TimingAttackPresentation2012.pdf slide 21\nhttps://crypto.stackexchange.com/questions/25607\nhttps://security.stackexchange.com/questions/9192\nhttps://crypto.stackexchange.com/questions/40433 \"If \"honey7dew\" is replaced by something with high entropy (hopeless to guess), there demonstrably is no attack enabled by timing of the comparison: if there was one, it would break the first preimage resistance of the hash.\"\n","description":null,"timestamp":"2020-07-30T08:36:01Z","authors":[{"email":"boogerlad@gmail.com","name":"boogerlad"}]},"hash":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC","authors":[],"deps":{"hashes":[["RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC","replace blake2 with blake3. I think node being a wrapper around openSSL makes it slow. 481,000ops/s vs 1,970,000ops/s\ndecrease token length and hash length to 128bits(argon2 waiting for pr to land: https://github.com/ranisalt/node-argon2/pull/266)\nhttps://security.stackexchange.com/questions/102157/do-you-need-more-than-128-bit-entropy \"128 bits of entropy are enough. if you generate a 256-bit AES key from a 128-bit seed and a strong PRNG, then you do not really have a 256-bit key.\"\nhttps://crypto.stackexchange.com/a/29618 \"if you had random binary tokens, a token longer than [hash function digest length]bits would be useless.\"\nhex encode instead of base64\nthere exists a timing attack via dictionary reduction on hash prefix discovery\ntherefore, not applicable to lobomj. password hashes are salted(if the salt is known, so is the hash) and tokens are of sufficient entropy to make brute force/dictionary infeasible.\nhttps://github.com/codahale/bcrypt-ruby/pull/43#issuecomment-15797932\nhttps://github.com/aj-code/TimingIntrusionTool5000/blob/master/TimingAttackPresentation2012.pdf slide 21\nhttps://crypto.stackexchange.com/questions/25607\nhttps://security.stackexchange.com/questions/9192\nhttps://crypto.stackexchange.com/questions/40433 \"If \"honey7dew\" is replaced by something with high entropy (hopeless to guess), there demonstrably is no attack enabled by timing of the comparison: if there was one, it would break the first preimage resistance of the hash.\"\n"],["AA",null],["P7WD6WSAMHM2UEDTWZW4WPHIFKJHOEELCHSBJ7YB5D57C7YEOVFQC","make `register` conform to response/request model. `data: token.toString('base64')` would imply error. put in a object to imply success\n"],["OQJOHZCSRMKF26K3QJPBDH4BH26GW2NIYJARTTMGLJ3WJWWUQVRAC","comment and publish new user TEST\n"],["TZJ5KFZ6XNQJFNDDMYGPURKC7JIC4E3DDB64T7D6PPC6YQRIJ6SQC","send stores on connection. will be needed most of the time anyways. since not request response model anymore, it's an event. buuut it doesn't fit into add / remove / update, so introduce replace\n"],["X3DVBHKNONHWE7NRRQ6FXXA6GRJ3P4NHROO547IEGSBJAA5CM5UAC","fix login_otp. postgres group by column inference doesn't work since cte doesn't have original table's primary key\nhttps://stackoverflow.com/a/50606823/\nhttps://dba.stackexchange.com/a/195105\n"],["2FPZGFF5PCGNV45HOB6TROMJFPURHPXM7YSPWNXCHFJS7EICVKQAC","authenticated and user count, remember me expiry, actually follow format, some pubsub fun, unregister, disallow multiple sockets with same credentials\n"],["WYTMZJFYVKHR4QH7AV5JUNWXT6NAC5NNQNPZCQSDI6LGI7DVXFYAC","user create, login, remember me. todo: logout, list all users, update profile, update user\n"],["7XVW32MMBBIGWQZ3QRD365TBIJU4DYN6T4VO2E46WFDCFHGO2BMAC","\"update profile\" endpoint. so far just email and password, but trivial to add more fields. admin edit user not done yet\nallow login via magic link\n"],["MM3HQWNEUZVOGQ3WWBTECBY6F47SN4U43I5UNDOAFWO3R7U5XPBAC","some links on range aggregation. rename password to passphrase. play around with artificial delay\n"],["7RKEQK2KPXJ2MEHPVSY7ROMHW6FTTKCXSMZV5MEXPFZKESZQYUUAC","ssh -i ~/lobogene-dev.pem ubuntu@www.lobogene.com \"PGPASSWORD=5vfKQhVfCc psql -t -AF $'\\t' --no-align -h 10.122.64.2 -U postgres -d webportal -c \\\"select email, encrypted_password, array_agg(result) from users inner join user_test_results on users.id = user_test_results.user_id inner join test_results on user_test_results.test_result_id = test_results.id group by users.id;\\\"\" | node gene2jane.js\n"],["JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC","update dependencies\ndeduplicate imports and stop reading the wrong .env\ndon't upgrade the connection to a websocket if wrong origin\nswitch from user type enum to god boolean + acl. this way, a user can be a(n) worker / owner of multiple stores\ndon't bother caching the user type in ws anymore. always get the truth from database\nskip stock check if just changing cart's user\nimplement otp login on connection as fallback to remember me token\non connection login event instead of firth\nreturn minimum number of fields from user\non unauthorized due to not >= store (owner || worker), update user acl event\nonly publish number of authenticated / connected on change\nregister logs in as well\nmerge cart (associate anonymous cart to user on login / register, transfer line item from anonymous cart to authenticated cart, add quantities of line items with same menu item together from anonymous to authenticated cart)\nend connection on logout and old connection if exists if login elsewhere\ntaxes for types (bc 20% vapes) + include tax in price when viewing products\nstock level now takes into account # of reserved\ntrigger for stock decrement on ready -> paid\nmin / max quantity filter for products\nwhen user / store deleted and last status of cart is 'placed' or 'ready', add fake final store / user cancelled event\nif god, created product will be visible for menu_item_loader. if store owner, not visible so that lobo can review\nimplement roles so that a store owner / worker can only access their stores defined by the acl for menu items, reservations\nimplement god see users' reservations and cancel\nimplement the rest of the reservation flow notifications (store status update, user cancel)\nimplement store add event\n\nsadly, lots of copy and paste. if the pattern is good, let's clean this up. I estimate 500 lines of code to be shaven off\n"],["4WREYORZT3SWUXADWHSS6B4PQSP3QSLH77CGNKRH6IRKUMX4TARAC","create store WIP\n"],["63VXWIHIAKGK7J4VTNRUAG2V32N2QUSWFELB6GD34S54FGRWAPCQC","rename strain_family to strain, strain to species\nsupport new schema\nmove queries to postgres function\n"],["5SAL2YA2IIYRBZSNM6SBKHSD6UFP67GDOR5J6W2WXREYLJZEFJ6AC","auto_login on open instead of separate message. token now in querystring instead of separate message after open. lowers latency and less boilerplate for auto reconnect.\n"],["VO5G3FF3NDOKCIF2OU7G257R3XIPTFDCAMDTOVKHKOB5Z3I55KDQC","dependencies\n"],["CLMZIURF2TXSMQ6YZYXR5CHGMRW6V64YFQLRCP3H3I3XB2KKOJ6AC","might as well upgrade every other dependency too\n"]],"deps":["P7WD6WSAMHM2UEDTWZW4WPHIFKJHOEELCHSBJ7YB5D57C7YEOVFQC"],"known":["WYTMZJFYVKHR4QH7AV5JUNWXT6NAC5NNQNPZCQSDI6LGI7DVXFYAC","2FPZGFF5PCGNV45HOB6TROMJFPURHPXM7YSPWNXCHFJS7EICVKQAC","OQJOHZCSRMKF26K3QJPBDH4BH26GW2NIYJARTTMGLJ3WJWWUQVRAC","4WREYORZT3SWUXADWHSS6B4PQSP3QSLH77CGNKRH6IRKUMX4TARAC","MM3HQWNEUZVOGQ3WWBTECBY6F47SN4U43I5UNDOAFWO3R7U5XPBAC","63VXWIHIAKGK7J4VTNRUAG2V32N2QUSWFELB6GD34S54FGRWAPCQC","7RKEQK2KPXJ2MEHPVSY7ROMHW6FTTKCXSMZV5MEXPFZKESZQYUUAC","5SAL2YA2IIYRBZSNM6SBKHSD6UFP67GDOR5J6W2WXREYLJZEFJ6AC","TZJ5KFZ6XNQJFNDDMYGPURKC7JIC4E3DDB64T7D6PPC6YQRIJ6SQC","7XVW32MMBBIGWQZ3QRD365TBIJU4DYN6T4VO2E46WFDCFHGO2BMAC","JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC","X3DVBHKNONHWE7NRRQ6FXXA6GRJ3P4NHROO547IEGSBJAA5CM5UAC"]},"hunks":[{"Edit":{"inode":{"change":16,"pos":145},"path":"package-lock.json","line":250,"atom":{"NewVertex":{"up_context":[{"change":16,"pos":2709}],"down_context":[{"change":16,"pos":2709}],"flag":"BLOCK","start":0,"end":245,"inode":{"change":16,"pos":145}}},"contents":[{"Add":{"text":" \"blake3\": {\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:16"}},{"Add":{"text":" \"version\": \"2.1.4\",\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:43"}},{"Add":{"text":" \"resolved\": \"https://registry.npmjs.org/blake3/-/blake3-2.1.4.tgz\",\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:118"}},{"Add":{"text":" \"integrity\": \"sha512-70hmx0lPd6zmtNwxPT4/1P0pqaEUlTJ0noUBvCXPLfMpN0o8PPaK3q7ZlpRIyhrqcXxeMAJSowNm/L9oi/x1XA==\"\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:236"}},{"Add":{"text":" },\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:244"}}]}},{"Edit":{"inode":{"change":16,"pos":29376},"path":"package.json","line":13,"atom":{"NewVertex":{"up_context":[{"change":16,"pos":29598}],"down_context":[{"change":17,"pos":9820}],"flag":"BLOCK","start":246,"end":271,"inode":{"change":16,"pos":29376}}},"contents":[{"Add":{"text":" \"blake3\": \"^2.1.4\",\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:270"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":5,"ins":{"up_context":[{"change":3,"pos":1871}],"down_context":[{"change":3,"pos":187}],"flag":"BLOCK","start":272,"end":394,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":999},"to":{"change":3,"start":999,"end":1034},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"const { hash: blake3 } = require('blake3/dist/node');//wasm is faster than neon(node-native) for small inputs (16 bytes)\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:393"}}],"del_contents":[{"Del":{"text":"const crypto = require('crypto');\r","pos":"WYTMZJFYVKHR4QH7AV5JUNWXT6NAC5NNQNPZCQSDI6LGI7DVXFYAC:1033"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":10,"ins":{"up_context":[{"change":3,"pos":19515}],"down_context":[{"change":3,"pos":19572}],"flag":"BLOCK","start":395,"end":463,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":19515},"to":{"change":3,"start":19515,"end":19572},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"const randomBytes = util.promisify(require('crypto').randomBytes);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:462"}}],"del_contents":[{"Del":{"text":"const randomBytes = util.promisify(crypto.randomBytes);\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:19571"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":83,"ins":{"up_context":[{"change":3,"pos":21038}],"down_context":[{"change":3,"pos":21409}],"flag":"BLOCK","start":464,"end":780,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":21038},"to":{"change":3,"start":21038,"end":21409},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\tlet user = (await pool.query('select user_id, email, god, json_object_agg(store_id, owner) filter (where store_id is not null) as acl from usr left join user_store using (user_id) where token_hash = $1 and now() < token_expiry group by user_id', [blake3(Buffer.from(ws.q.token, 'hex'), {length: 16})])).rows[0];\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:779"}}],"del_contents":[{"Del":{"text":"\t\t\tlet user = (await pool.query('select user_id, email, god, json_object_agg(store_id, owner) filter (where store_id is not null) as acl from usr left join user_store using (user_id) where token_hash = $1 and now() < token_expiry group by user_id', [crypto.createHash('BLAKE2b512').update(Buffer.from(ws.q.token, 'base64')).digest()])).rows[0];//possible timing attack?\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:21408"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":111,"ins":{"up_context":[{"change":3,"pos":22200}],"down_context":[{"change":3,"pos":22240}],"flag":"BLOCK","start":781,"end":820,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":22200},"to":{"change":3,"start":22200,"end":22240},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\tlet token = await randomBytes(16);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:819"}}],"del_contents":[{"Del":{"text":"\t\t\tlet token = await randomBytes(128);\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:22239"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":130,"ins":{"up_context":[{"change":3,"pos":22666}],"down_context":[{"change":3,"pos":22821}],"flag":"BLOCK","start":821,"end":913,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":22666},"to":{"change":3,"start":22666,"end":22821},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\tblake3(token, {length: 16}),\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:855"}},{"Add":{"text":"\t\t\t\t\tblake3(Buffer.from(ws.q.otp, 'hex'), {length: 16})\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:912"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\tcrypto.createHash('BLAKE2b512').update(token).digest(),\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:22727"}},{"Del":{"text":"\t\t\t\t\tcrypto.createHash('BLAKE2b512').update(Buffer.from(parameters.otp, 'base64')).digest()\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:22820"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":133,"ins":{"up_context":[{"change":3,"pos":22828}],"down_context":[{"change":3,"pos":22869}],"flag":"BLOCK","start":914,"end":930,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":22828},"to":{"change":3,"start":22828,"end":22869},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t)).rows[0];\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:929"}}],"del_contents":[{"Del":{"text":"\t\t\t)).rows[0];//possible timing attack?\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:22868"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":147,"ins":{"up_context":[{"change":3,"pos":23079}],"down_context":[{"change":3,"pos":23123}],"flag":"BLOCK","start":931,"end":972,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":23079},"to":{"change":3,"start":23079,"end":23123},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\tuser.token = token.toString('hex');\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:971"}}],"del_contents":[{"Del":{"text":"\t\t\t\tuser.token = token.toString('base64');\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:23122"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":258,"ins":{"up_context":[{"change":3,"pos":624}],"down_context":[{"change":3,"pos":879}],"flag":"BLOCK","start":973,"end":1238,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":624},"to":{"change":3,"start":624,"end":879},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\tlet token = await randomBytes(16);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1013"}},{"Add":{"text":"\t\t\t\t\tif((await pool.query(`update usr set otp_expiry = now() + interval '5 minute', otp_hash = $2 where email = $1`, [parameters.email, blake3(token, {length: 16})])).rowCount === 1) {\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1199"}},{"Add":{"text":"\t\t\t\t\t\ttoken = token.toString('hex');\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1237"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\tlet token = await randomBytes(128);\r","pos":"7XVW32MMBBIGWQZ3QRD365TBIJU4DYN6T4VO2E46WFDCFHGO2BMAC:665"}},{"Del":{"text":"\t\t\t\t\tif((await pool.query(`update usr set otp_expiry = now() + interval '5 minute', otp_hash = $2 where email = $1`, [parameters.email, crypto.createHash('BLAKE2b512').update(token).digest()])).rowCount === 1) {\r","pos":"7XVW32MMBBIGWQZ3QRD365TBIJU4DYN6T4VO2E46WFDCFHGO2BMAC:878"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":265,"ins":{"up_context":[{"change":3,"pos":1036}],"down_context":[{"change":3,"pos":1292}],"flag":"BLOCK","start":1239,"end":1457,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1036},"to":{"change":3,"start":1036,"end":1292},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\thtml: `idk

Alternatively, copy and paste ${token} into the input field

if this wasn't you, let us know by replying to this email.`\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1456"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\thtml: `idk

Alternatively, copy and paste ${token.toString('base64')} into the input field

if this wasn't you, let us know by replying to this email.`\r","pos":"7XVW32MMBBIGWQZ3QRD365TBIJU4DYN6T4VO2E46WFDCFHGO2BMAC:1291"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":290,"ins":{"up_context":[{"change":3,"pos":1974}],"down_context":[{"change":3,"pos":26188}],"flag":"BLOCK","start":1458,"end":1499,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1974},"to":{"change":3,"start":1974,"end":2016},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\tlet token = await randomBytes(16);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1498"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\tlet token = await randomBytes(128);\r","pos":"7XVW32MMBBIGWQZ3QRD365TBIJU4DYN6T4VO2E46WFDCFHGO2BMAC:2015"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":309,"ins":{"up_context":[{"change":3,"pos":26650}],"down_context":[{"change":3,"pos":26809}],"flag":"BLOCK","start":1500,"end":1602,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":26650},"to":{"change":3,"start":26650,"end":26809},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\tblake3(token, {length: 16}),\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1536"}},{"Add":{"text":"\t\t\t\t\t\t\tblake3(Buffer.from(parameters.otp, 'hex'), {length: 16})\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1601"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\tcrypto.createHash('BLAKE2b512').update(token).digest(),\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:26713"}},{"Del":{"text":"\t\t\t\t\t\t\tcrypto.createHash('BLAKE2b512').update(Buffer.from(parameters.otp, 'base64')).digest()\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:26808"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":312,"ins":{"up_context":[{"change":3,"pos":26818}],"down_context":[{"change":3,"pos":2411}],"flag":"BLOCK","start":1603,"end":1621,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":26818},"to":{"change":3,"start":26818,"end":26861},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t)).rows[0];\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1620"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t)).rows[0];//possible timing attack?\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:26860"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":390,"ins":{"up_context":[{"change":3,"pos":29739}],"down_context":[{"change":3,"pos":2701}],"flag":"BLOCK","start":1622,"end":1665,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"","flag":"DELETED","from":{"change":3,"pos":29739},"to":{"change":3,"start":2655,"end":2701},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":2655},"to":{"change":3,"start":2655,"end":2701},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\tuser.token = token.toString('hex');\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1664"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\tuser.token = token.toString('base64');\r","pos":"7XVW32MMBBIGWQZ3QRD365TBIJU4DYN6T4VO2E46WFDCFHGO2BMAC:2700"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":417,"ins":{"up_context":[{"change":3,"pos":1734}],"down_context":[{"change":3,"pos":30121}],"flag":"BLOCK","start":1666,"end":1708,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1734},"to":{"change":3,"start":30078,"end":30121},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\tlet token = await randomBytes(16);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1707"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\tlet token = await randomBytes(128);\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:30120"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":433,"ins":{"up_context":[{"change":3,"pos":30599}],"down_context":[{"change":3,"pos":30664}],"flag":"BLOCK","start":1709,"end":1747,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":30599},"to":{"change":3,"start":30599,"end":30664},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\tblake3(token, {length: 16}),\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1746"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\tcrypto.createHash('BLAKE2b512').update(token).digest(),\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:30663"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":439,"ins":{"up_context":[{"change":3,"pos":30779}],"down_context":[{"change":3,"pos":30879}],"flag":"BLOCK","start":1748,"end":1854,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":30779},"to":{"change":2,"start":0,"end":109},"introduced_by":2}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\tdata: {token: token.toString('hex')}/*sharedworker needs to intercept this and emit virtual event\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1853"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\tdata: {token: token.toString('base64')}/*sharedworker needs to intercept this and emit virtual event\r","pos":"P7WD6WSAMHM2UEDTWZW4WPHIFKJHOEELCHSBJ7YB5D57C7YEOVFQC:108"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":511,"ins":{"up_context":[{"change":3,"pos":5536}],"down_context":[{"change":3,"pos":31741}],"flag":"BLOCK","start":1855,"end":1899,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":2852},"to":{"change":3,"start":2852,"end":2897},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\tlet token = await randomBytes(16);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:1898"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\tlet token = await randomBytes(128);\r","pos":"WYTMZJFYVKHR4QH7AV5JUNWXT6NAC5NNQNPZCQSDI6LGI7DVXFYAC:2896"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":513,"ins":{"up_context":[{"change":3,"pos":31787}],"down_context":[{"change":3,"pos":31990}],"flag":"BLOCK","start":1900,"end":2027,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":31787},"to":{"change":3,"start":31787,"end":31990},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\tawait client.query('update usr set token_hash = $1 where user_id = $2', [blake3(token, {length: 16}), user.user_id]);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:2026"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\tawait client.query('update usr set token_hash = $1 where user_id = $2', [crypto.createHash('BLAKE2b512').update(token).digest(), user.user_id]);//update to blake3 once it's available in openSSL\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:31989"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":582,"ins":{"up_context":[{"change":3,"pos":34899}],"down_context":[{"change":3,"pos":2229}],"flag":"BLOCK","start":2028,"end":2247,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":34899},"to":{"change":3,"start":34899,"end":35008},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\t//yuck, since json can't send binary, need to hex encode. fyi base64 is smaller than hex(base16), but after compressing, hex is smaller. also base64 has issues with regards to url encoding, and slower than hex\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:2246"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\t//yuck, since json can't send binary, need to base64 encode. fyi base64 is smaller than hex(base16)\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:35007"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":587,"ins":{"up_context":[{"change":3,"pos":2515}],"down_context":[{"change":3,"pos":2536}],"flag":"BLOCK","start":2248,"end":2325,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":2515},"to":{"change":3,"start":35009,"end":35089},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\t\tdata: {token: token.toString('hex'), god: user.god, acl: user.acl}\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:2324"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\t\tdata: {token: token.toString('base64'), god: user.god, acl: user.acl}\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:35088"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":602,"ins":{"up_context":[{"change":3,"pos":3279}],"down_context":[{"change":3,"pos":35425}],"flag":"BLOCK","start":2326,"end":2370,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":3314},"to":{"change":3,"start":3314,"end":3359},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\tlet token = await randomBytes(16);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:2369"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\tlet token = await randomBytes(128);\r","pos":"7RKEQK2KPXJ2MEHPVSY7ROMHW6FTTKCXSMZV5MEXPFZKESZQYUUAC:3358"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":604,"ins":{"up_context":[{"change":3,"pos":35471}],"down_context":[{"change":3,"pos":35761}],"flag":"BLOCK","start":2371,"end":2585,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":35471},"to":{"change":3,"start":35471,"end":35761},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\tawait client.query('update usr set token_hash = $1, passphrase_hash = $3, webportal_hash = null where user_id = $2', [blake3(token, {length: 16}), user.user_id, await argon2.hash(parameters.passphrase)]);\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:2584"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\tawait client.query('update usr set token_hash = $1, passphrase_hash = $3, webportal_hash = null where user_id = $2', [crypto.createHash('BLAKE2b512').update(token).digest(), user.user_id, await argon2.hash(parameters.passphrase)]);//update to blake3 once it's available in openSSL\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:35760"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":673,"ins":{"up_context":[{"change":3,"pos":38670}],"down_context":[{"change":3,"pos":1687}],"flag":"BLOCK","start":2586,"end":2805,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":38670},"to":{"change":3,"start":38670,"end":38779},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\t//yuck, since json can't send binary, need to hex encode. fyi base64 is smaller than hex(base16), but after compressing, hex is smaller. also base64 has issues with regards to url encoding, and slower than hex\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:2804"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\t//yuck, since json can't send binary, need to base64 encode. fyi base64 is smaller than hex(base16)\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:38778"}}]}},{"Replacement":{"inode":{"change":3,"pos":590},"path":"server.js","line":678,"ins":{"up_context":[{"change":3,"pos":3500}],"down_context":[{"change":3,"pos":3521}],"flag":"BLOCK","start":2806,"end":2883,"inode":{"change":3,"pos":590}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":3500},"to":{"change":3,"start":38780,"end":38860},"introduced_by":3}],"inode":{"change":3,"pos":590}},"ins_contents":[{"Add":{"text":"\t\t\t\t\t\t\t\t\tdata: {token: token.toString('hex'), god: user.god, acl: user.acl}\r","pos":"RAN5QU4U2OVNLDGZVVTJNCXDN5GNAVPXGKHADZO2ML3Y5KLU4QPQC:2882"}}],"del_contents":[{"Del":{"text":"\t\t\t\t\t\t\t\t\tdata: {token: token.toString('base64'), god: user.god, acl: user.acl}\r","pos":"JP2LJ6B34S4IS6MPKF5LMMYUWIYMGU3JCJRRR4PTZ4IWM653JCXAC:38859"}}]}}],"owner":"boogerlad","repo":"mj","token":"9KpMdmZQ7v2YnLZVGBJzovYDIK85pl3IuVcbuci99cw=","login":null}

…

Dependencies

Change contents

Review