MirrorMirror
/
Signal-Server
mirror of https://github.com/signalapp/Signal-Server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add requester to recaptcha validation

This commit is contained in:
Moxie Marlinspike 2019-07-11 12:38:22 -07:00
parent 288285f22b
commit a6e7e30177
3 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
service/src/main/java/org/whispersystems/textsecuregcm/controllers/AccountController.java
View File

@ -401,7 +401,7 @@ public class AccountController {
{ {
if (captchaToken.isPresent()) { if (captchaToken.isPresent()) {
boolean validToken = recaptchaClient.verify(captchaToken.get()); boolean validToken = recaptchaClient.verify(captchaToken.get(), requester);
if (validToken) { if (validToken) {
captchaSuccessMeter.mark(); captchaSuccessMeter.mark();

3
service/src/main/java/org/whispersystems/textsecuregcm/recaptcha/RecaptchaClient.java
View File

@ -21,10 +21,11 @@ public class RecaptchaClient {
this.recaptchaSecret = recaptchaSecret; this.recaptchaSecret = recaptchaSecret;
} }
public boolean verify(String captchaToken) { public boolean verify(String captchaToken, String ip) {
MultivaluedMap<String, String> formData = new MultivaluedHashMap<>(); MultivaluedMap<String, String> formData = new MultivaluedHashMap<>();
formData.add("secret", recaptchaSecret); formData.add("secret", recaptchaSecret);
formData.add("response", captchaToken); formData.add("response", captchaToken);
formData.add("remoteip", ip);
VerifyResponse response = client.target("https://www.google.com/recaptcha/api/siteverify") VerifyResponse response = client.target("https://www.google.com/recaptcha/api/siteverify")
.request() .request()

8
service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/AccountControllerTest.java
View File

@ -130,8 +130,8 @@ public class AccountControllerTest {
when(abusiveHostRules.getAbusiveHostRulesFor(eq(RESTRICTED_HOST))).thenReturn(Collections.singletonList(new AbusiveHostRule(RESTRICTED_HOST, false, Collections.singletonList("+123")))); when(abusiveHostRules.getAbusiveHostRulesFor(eq(RESTRICTED_HOST))).thenReturn(Collections.singletonList(new AbusiveHostRule(RESTRICTED_HOST, false, Collections.singletonList("+123"))));
when(abusiveHostRules.getAbusiveHostRulesFor(eq(NICE_HOST))).thenReturn(Collections.emptyList()); when(abusiveHostRules.getAbusiveHostRulesFor(eq(NICE_HOST))).thenReturn(Collections.emptyList());
when(recaptchaClient.verify(eq(INVALID_CAPTCHA_TOKEN))).thenReturn(false); when(recaptchaClient.verify(eq(INVALID_CAPTCHA_TOKEN), anyString())).thenReturn(false);
when(recaptchaClient.verify(eq(VALID_CAPTCHA_TOKEN))).thenReturn(true); when(recaptchaClient.verify(eq(VALID_CAPTCHA_TOKEN), anyString())).thenReturn(true);
doThrow(new RateLimitExceededException(SENDER_OVER_PIN)).when(pinLimiter).validate(eq(SENDER_OVER_PIN)); doThrow(new RateLimitExceededException(SENDER_OVER_PIN)).when(pinLimiter).validate(eq(SENDER_OVER_PIN));
@ -216,7 +216,7 @@ public class AccountControllerTest {
assertThat(response.getStatus()).isEqualTo(200); assertThat(response.getStatus()).isEqualTo(200);
verifyNoMoreInteractions(abusiveHostRules); verifyNoMoreInteractions(abusiveHostRules);
verify(recaptchaClient).verify(eq(VALID_CAPTCHA_TOKEN)); verify(recaptchaClient).verify(eq(VALID_CAPTCHA_TOKEN), eq(ABUSIVE_HOST));
verify(smsSender).deliverSmsVerification(eq(SENDER), eq(Optional.empty()), anyString()); verify(smsSender).deliverSmsVerification(eq(SENDER), eq(Optional.empty()), anyString());
} }
@ -233,7 +233,7 @@ public class AccountControllerTest {
assertThat(response.getStatus()).isEqualTo(402); assertThat(response.getStatus()).isEqualTo(402);
verifyNoMoreInteractions(abusiveHostRules); verifyNoMoreInteractions(abusiveHostRules);
verify(recaptchaClient).verify(eq(INVALID_CAPTCHA_TOKEN)); verify(recaptchaClient).verify(eq(INVALID_CAPTCHA_TOKEN), eq(ABUSIVE_HOST));
verifyNoMoreInteractions(smsSender); verifyNoMoreInteractions(smsSender);
} }