)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"93ee82a1a74fca958fe821bc8f90b570ee591a98","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"More random values for oAuth1 verifier"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The oAuth1 verifier was generated as a random number ranging from"},{"line_number":10,"context_line":"1000 to 9999. This small range of numbers is vulnerable to"},{"line_number":11,"context_line":"brute-force attacks as described in CWE-330. The verifier is now"},{"line_number":12,"context_line":"a 8-character long alphanumerical string, a good compromise between"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"AAAAXH%2F%2FIQg%3D","line":9,"updated":"2014-04-23 19:59:31.000000000","message":"Nice commit message!  Great description!","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"360c888242b6277049ea24063e97ccdf1507baf7","unresolved":false,"context_lines":[{"line_number":11,"context_line":"brute-force attacks as described in CWE-330. The verifier is now"},{"line_number":12,"context_line":"a 8-character long alphanumerical string, a good compromise between"},{"line_number":13,"context_line":"security against guessing and ease of use."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: Ibe4a2e57a02c261d85ba6c0d61696f134c54443e"},{"line_number":16,"context_line":"Closes-Bug: #1236675"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"AAAAXH%2F%2FHQE%3D","line":14,"updated":"2014-04-23 22:48:40.000000000","message":"Add SecurityImpact","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"a9f0b5cece2314e0c521f77a015b9d918baaeeda","unresolved":false,"context_lines":[{"line_number":11,"context_line":"brute-force attacks as described in CWE-330. The verifier is now"},{"line_number":12,"context_line":"a 8-character long alphanumerical string, a good compromise between"},{"line_number":13,"context_line":"security against guessing and ease of use."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: Ibe4a2e57a02c261d85ba6c0d61696f134c54443e"},{"line_number":16,"context_line":"Closes-Bug: #1236675"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"AAAAXH%2F%2FEcE%3D","line":14,"in_reply_to":"AAAAXH%2F%2FHQE%3D","updated":"2014-04-24 09:26:17.000000000","message":"Done","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"}],"keystone/contrib/oauth1/backends/sql.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"360c888242b6277049ea24063e97ccdf1507baf7","unresolved":false,"context_lines":[{"line_number":205,"context_line":"            token_dict \u003d token_ref.to_dict()"},{"line_number":206,"context_line":"            token_dict[\u0027authorizing_user_id\u0027] \u003d user_id"},{"line_number":207,"context_line":"            token_dict[\u0027verifier\u0027] \u003d \u0027\u0027.join(random.sample(core.VERIFIER_CHARS,"},{"line_number":208,"context_line":"                                                           8))"},{"line_number":209,"context_line":"            token_dict[\u0027role_ids\u0027] \u003d jsonutils.dumps(role_ids)"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"            new_token \u003d RequestToken.from_dict(token_dict)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FHO4%3D","line":208,"updated":"2014-04-23 22:48:40.000000000","message":"http://tools.ietf.org/html/rfc5849 has a verifier strings which are 16 bytes (and also has 8 bytes, so I don\u0027t know what a good length is).","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"a9f0b5cece2314e0c521f77a015b9d918baaeeda","unresolved":false,"context_lines":[{"line_number":205,"context_line":"            token_dict \u003d token_ref.to_dict()"},{"line_number":206,"context_line":"            token_dict[\u0027authorizing_user_id\u0027] \u003d user_id"},{"line_number":207,"context_line":"            token_dict[\u0027verifier\u0027] \u003d \u0027\u0027.join(random.sample(core.VERIFIER_CHARS,"},{"line_number":208,"context_line":"                                                           8))"},{"line_number":209,"context_line":"            token_dict[\u0027role_ids\u0027] \u003d jsonutils.dumps(role_ids)"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"            new_token \u003d RequestToken.from_dict(token_dict)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FEdI%3D","line":208,"in_reply_to":"AAAAXH%2F%2FHO4%3D","updated":"2014-04-24 09:26:17.000000000","message":"The only recommendation I could find about the verifier is this: \"If the server knows a client to be running on a limited device, it SHOULD ensure that the verifier value is suitable for manual entry.\" Using 8 characters here is purely arbitrary as it is perceived as a compromise between ease of use and protection against bruteforce, so I am open to change.","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"}],"keystone/contrib/oauth1/core.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"360c888242b6277049ea24063e97ccdf1507baf7","unresolved":false,"context_lines":[{"line_number":40,"context_line":"SIG_HMAC \u003d oauth1.SIGNATURE_HMAC"},{"line_number":41,"context_line":"RequestTokenEndpoint \u003d oauth1.RequestTokenEndpoint"},{"line_number":42,"context_line":"oRequest \u003d oauthlib.common.Request"},{"line_number":43,"context_line":"VERIFIER_CHARS \u003d string.ascii_letters + string.digits"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"class Token(object):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FHMg%3D","line":43,"updated":"2014-04-23 22:48:40.000000000","message":"add a comment why this has to be limited to ascii chars and digits.","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"a9f0b5cece2314e0c521f77a015b9d918baaeeda","unresolved":false,"context_lines":[{"line_number":40,"context_line":"SIG_HMAC \u003d oauth1.SIGNATURE_HMAC"},{"line_number":41,"context_line":"RequestTokenEndpoint \u003d oauth1.RequestTokenEndpoint"},{"line_number":42,"context_line":"oRequest \u003d oauthlib.common.Request"},{"line_number":43,"context_line":"VERIFIER_CHARS \u003d string.ascii_letters + string.digits"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"class Token(object):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FEPs%3D","line":43,"in_reply_to":"AAAAXH%2F%2FHMg%3D","updated":"2014-04-24 09:26:17.000000000","message":"Done","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"550d267920e4bf184abce893604b59ae5e90680b","unresolved":false,"context_lines":[{"line_number":41,"context_line":"RequestTokenEndpoint \u003d oauth1.RequestTokenEndpoint"},{"line_number":42,"context_line":"oRequest \u003d oauthlib.common.Request"},{"line_number":43,"context_line":"# limited to alphanumerical values for ease of manual entry"},{"line_number":44,"context_line":"VERIFIER_CHARS \u003d string.ascii_letters + string.digits"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"class Token(object):"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAXH%2F%2FCQU%3D","line":44,"updated":"2014-04-24 14:01:08.000000000","message":"should remove the characters from this collection that are commonly confused, like j i I l 1 o O 0","commit_id":"672165b68c1d6a5f9d4538f985b2578deedbf4be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"e58fa0fd42cf04342e1f9facd07e5a85d517b511","unresolved":false,"context_lines":[{"line_number":21,"context_line":"import oauthlib.common"},{"line_number":22,"context_line":"from oauthlib import oauth1"},{"line_number":23,"context_line":"import six"},{"line_number":24,"context_line":"import string"},{"line_number":25,"context_line":"import uuid"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"from keystone.common import dependency"}],"source_content_type":"text/x-python","patch_set":5,"id":"bad4c104_f10fc72c","line":24,"updated":"2014-04-29 13:11:09.000000000","message":"This should be move up to the stdlib import section.","commit_id":"9453203bf1b772de93c34680f4e782c55dd7a71e"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"e58fa0fd42cf04342e1f9facd07e5a85d517b511","unresolved":false,"context_lines":[{"line_number":43,"context_line":"# The characters used to generate verifiers are limited to alphanumerical"},{"line_number":44,"context_line":"# values for ease of manual entry. Commonly confused characters are omitted."},{"line_number":45,"context_line":"VERIFIER_CHARS \u003d (string.ascii_letters +"},{"line_number":46,"context_line":"                  string.digits).translate(None, \u0027jiIl1oO0\u0027)"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"class Token(object):"}],"source_content_type":"text/x-python","patch_set":5,"id":"bad4c104_362cc5ab","line":46,"updated":"2014-04-29 13:11:09.000000000","message":"The translate method in Py3 only take a table argument now. Another way to do this is:\n\n    VERIFIER_CHARS \u003d (string.ascii_letters + string.digits)\n    VERIFIER_CHARS \u003d \u0027\u0027.join(c for c in VERIFIER_CHARS if c not in \u0027jiIl1oO0\u0027)\n\nYou could even name the string \u0027delchars\u0027 or something similar for more clarity.","commit_id":"9453203bf1b772de93c34680f4e782c55dd7a71e"}],"keystone/contrib/oauth1/validator.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"915e4ad8a69cf8078f6c58c262a0fce3e5666f86","unresolved":false,"context_lines":[{"line_number":59,"context_line":"        return set(nonce) \u003c\u003d self.safe_characters"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    def check_verifier(self, verifier):"},{"line_number":62,"context_line":"        chars \u003d string.ascii_letters + string.digits"},{"line_number":63,"context_line":"        try:"},{"line_number":64,"context_line":"            return all(i in chars for i in verifier) and (len(verifier) \u003d\u003d 8)"},{"line_number":65,"context_line":"        except ValueError:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAXH%2F%2FSxk%3D","line":62,"updated":"2014-04-22 17:41:12.000000000","message":"string.ascii_letters + string.digits is declared in both changed files.\n\nI think you can declare this in keystone.contrib.oauth1.core and call it from here, and the sql backend.","commit_id":"bd993ea43e95ebda54611e0f5c6e1554ef4ae719"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f101909ede0518670b83bce941b430156b584474","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    def check_verifier(self, verifier):"},{"line_number":61,"context_line":"        try:"},{"line_number":62,"context_line":"            return all(i in oauth1.VERIFIER_CHARS for i in verifier) and\\"},{"line_number":63,"context_line":"                (len(verifier) \u003d\u003d 8)"},{"line_number":64,"context_line":"        except ValueError:"},{"line_number":65,"context_line":"            return False"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FLdc%3D","line":62,"updated":"2014-04-23 14:23:16.000000000","message":"nit: i think you can wrap this in () instead of using \\","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"360c888242b6277049ea24063e97ccdf1507baf7","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    def check_verifier(self, verifier):"},{"line_number":61,"context_line":"        try:"},{"line_number":62,"context_line":"            return all(i in oauth1.VERIFIER_CHARS for i in verifier) and\\"},{"line_number":63,"context_line":"                (len(verifier) \u003d\u003d 8)"},{"line_number":64,"context_line":"        except ValueError:"},{"line_number":65,"context_line":"            return False"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FHMM%3D","line":62,"updated":"2014-04-23 22:48:40.000000000","message":"use () rather than \\.","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"a9f0b5cece2314e0c521f77a015b9d918baaeeda","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    def check_verifier(self, verifier):"},{"line_number":61,"context_line":"        try:"},{"line_number":62,"context_line":"            return all(i in oauth1.VERIFIER_CHARS for i in verifier) and\\"},{"line_number":63,"context_line":"                (len(verifier) \u003d\u003d 8)"},{"line_number":64,"context_line":"        except ValueError:"},{"line_number":65,"context_line":"            return False"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FEZY%3D","line":62,"in_reply_to":"AAAAXH%2F%2FHMM%3D","updated":"2014-04-24 09:26:17.000000000","message":"Done","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"360c888242b6277049ea24063e97ccdf1507baf7","unresolved":false,"context_lines":[{"line_number":60,"context_line":"    def check_verifier(self, verifier):"},{"line_number":61,"context_line":"        try:"},{"line_number":62,"context_line":"            return all(i in oauth1.VERIFIER_CHARS for i in verifier) and\\"},{"line_number":63,"context_line":"                (len(verifier) \u003d\u003d 8)"},{"line_number":64,"context_line":"        except ValueError:"},{"line_number":65,"context_line":"            return False"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FHLY%3D","line":63,"updated":"2014-04-23 22:48:40.000000000","message":"why do we need to check the verifier in this way? Couldn\u0027t a different oauth server generate a different verifier?","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"a9f0b5cece2314e0c521f77a015b9d918baaeeda","unresolved":false,"context_lines":[{"line_number":60,"context_line":"    def check_verifier(self, verifier):"},{"line_number":61,"context_line":"        try:"},{"line_number":62,"context_line":"            return all(i in oauth1.VERIFIER_CHARS for i in verifier) and\\"},{"line_number":63,"context_line":"                (len(verifier) \u003d\u003d 8)"},{"line_number":64,"context_line":"        except ValueError:"},{"line_number":65,"context_line":"            return False"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FERI%3D","line":63,"in_reply_to":"AAAAXH%2F%2FHLY%3D","updated":"2014-04-24 09:26:17.000000000","message":"Yes but we check verifiers that have been issued by ourselves, never from another server.","commit_id":"3093b7ee65f84e800bd03444cb33c7e19f16543a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6af016a4b5c3238505397f69d3c92fa7f6b99242","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        try:"},{"line_number":62,"context_line":"            return (all(i in oauth1.VERIFIER_CHARS for i in verifier) and"},{"line_number":63,"context_line":"                    len(verifier) \u003d\u003d 8)"},{"line_number":64,"context_line":"        except ValueError:"},{"line_number":65,"context_line":"            return False"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    def get_client_secret(self, client_key, request):"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAXX%2F%2F8mQ%3D","line":64,"updated":"2014-04-25 06:08:26.000000000","message":"Do we still need this? I removed the try-except and the tests I ran passed. I don\u0027t see what would raise a ValueError anymore.","commit_id":"fd719997c185d016637dca0237bd8c145415c7e8"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"c357237b637bb9f4998306e6454490dac0280ae6","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        try:"},{"line_number":62,"context_line":"            return (all(i in oauth1.VERIFIER_CHARS for i in verifier) and"},{"line_number":63,"context_line":"                    len(verifier) \u003d\u003d 8)"},{"line_number":64,"context_line":"        except ValueError:"},{"line_number":65,"context_line":"            return False"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    def get_client_secret(self, client_key, request):"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAXX%2F%2F7nI%3D","line":64,"in_reply_to":"AAAAXX%2F%2F8mQ%3D","updated":"2014-04-25 08:15:29.000000000","message":"True, I can turn it into a TypeError in the unlikely case verifier isn\u0027t iterable or an object with no len(), or simply remove the try-except","commit_id":"fd719997c185d016637dca0237bd8c145415c7e8"}]}