diff options
| author | Zuul <zuul@review.opendev.org> | 2022-02-11 18:43:39 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2022-02-11 18:43:39 +0000 |
| commit | 2c10eff409182a7960bc5691e0bd02eab8dcb133 (patch) | |
| tree | 193c7fbb13ecdcd70e4fbb4875949d0bff24c789 | |
| parent | 3cbd374947cdcfb890cc9ddf5df6216ce2557e0b (diff) | |
| parent | 0b64050e6b3daeed0aee4496d6cba2c31eeb7d83 (diff) | |
| download | keystone-2c10eff409182a7960bc5691e0bd02eab8dcb133.tar.gz | |
Merge "using standard library secrets function token_bytes to replace os.urandom"
| -rw-r--r-- | keystone/api/users.py | 4 | ||||
| -rw-r--r-- | keystone/common/cache/core.py | 4 | ||||
| -rw-r--r-- | keystone/tests/unit/core.py | 6 |
3 files changed, 8 insertions, 6 deletions
diff --git a/keystone/api/users.py b/keystone/api/users.py index 10f26bd42..3fd4e4190 100644 --- a/keystone/api/users.py +++ b/keystone/api/users.py @@ -13,7 +13,7 @@ # This file handles all flask-restful resources for /v3/users import base64 -import os +import secrets import uuid import flask @@ -577,7 +577,7 @@ class UserAppCredListCreateResource(ks_flask.ResourceBase): @staticmethod def _generate_secret(): length = 64 - secret = os.urandom(length) + secret = secrets.token_bytes(length) secret = base64.urlsafe_b64encode(secret) secret = secret.rstrip(b'=') secret = secret.decode('utf-8') diff --git a/keystone/common/cache/core.py b/keystone/common/cache/core.py index de0d8a023..fb9fc1ca8 100644 --- a/keystone/common/cache/core.py +++ b/keystone/common/cache/core.py @@ -14,7 +14,7 @@ """Keystone Caching Layer Implementation.""" -import os +import secrets from dogpile.cache import region from dogpile.cache import util @@ -36,7 +36,7 @@ class RegionInvalidationManager(object): self._region_key = self.REGION_KEY_PREFIX + region_name def _generate_new_id(self): - return os.urandom(10) + return secrets.token_bytes(10) @property def region_id(self): diff --git a/keystone/tests/unit/core.py b/keystone/tests/unit/core.py index c8b71cff3..2a6c12038 100644 --- a/keystone/tests/unit/core.py +++ b/keystone/tests/unit/core.py @@ -19,6 +19,8 @@ import datetime import functools import hashlib import json +import secrets + import ldap import os import shutil @@ -421,9 +423,9 @@ def new_ec2_credential(user_id, project_id=None, blob=None, **kwargs): def new_totp_credential(user_id, project_id=None, blob=None): if not blob: - # NOTE(notmorgan): 20 bytes of data from os.urandom for + # NOTE(notmorgan): 20 bytes of data from secrets.token_bytes for # a totp secret. - blob = base64.b32encode(os.urandom(20)).decode('utf-8') + blob = base64.b32encode(secrets.token_bytes(20)).decode('utf-8') credential = new_credential_ref(user_id=user_id, project_id=project_id, blob=blob, |