From bc0863cae099b82fd1b269038c3b2f99dc2c6020 Mon Sep 17 00:00:00 2001 From: Toby Moreno Date: Sat, 8 Aug 2026 22:54:24 -0700 Subject: [PATCH] Prevent VAmPI credential enumeration Use a generic unauthorized response for unknown usernames and incorrect passwords so login behavior does not reveal which account data exists. Add focused regression coverage. Signed-off-by: Toby Moreno --- api_views/users.py | 13 +++---------- tests/test_enumeration.py | 9 +++++++++ 2 files changed, 12 insertions(+), 10 deletions(-) create mode 100644 tests/test_enumeration.py diff --git a/api_views/users.py b/api_views/users.py index 172540a..e819d5a 100644 --- a/api_views/users.py +++ b/api_views/users.py @@ -98,16 +98,9 @@ def login_user(): 'auth_token': auth_token } return Response(json.dumps(responseObject), 200, mimetype="application/json") - if vuln: # Password Enumeration - if user and request_data.get('password') != user.password: - return Response(error_message_helper("Password is not correct for the given username."), 200, - mimetype="application/json") - elif not user: # User enumeration - return Response(error_message_helper("Username does not exist"), 200, mimetype="application/json") - else: - if (user and request_data.get('password') != user.password) or (not user): - return Response(error_message_helper("Username or Password Incorrect!"), 200, - mimetype="application/json") + if (user and request_data.get('password') != user.password) or (not user): + return Response(error_message_helper("Username or Password Incorrect!"), 401, + mimetype="application/json") except jsonschema.exceptions.ValidationError as exc: return Response(error_message_helper(exc.message), 400, mimetype="application/json") except: diff --git a/tests/test_enumeration.py b/tests/test_enumeration.py new file mode 100644 index 0000000..4da950a --- /dev/null +++ b/tests/test_enumeration.py @@ -0,0 +1,9 @@ +from pathlib import Path + + +def test_login_uses_generic_failure_for_unknown_users_and_passwords(): + source = Path("api_views/users.py").read_text() + section = source[source.index("def login_user"):source.index("def token_validator")] + assert "Password is not correct" not in section + assert "Username does not exist" not in section + assert "Username or Password Incorrect!" in section