#736 Generate hash and sign/verify data for secrettext values #1005
Conversation
github-actions
bot
added
AL: System Application
From Fork
| begin | ||
| exit(GenerateHash(InputString.Unwrap(), Key, HashAlgorithmType)); | ||
| end; | ||
|
|
||
| [NonDebuggable] | ||
| procedure GenerateHash(InputString: Text; "Key": SecretText; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text |
There was a problem hiding this comment.
Update this function to take in SecretText for the InputString and unwrap the value only here. While the rest of the functions can pass either Text or SecretText until it gets to this.
Add overloads as needed.
We don't want to unwrap any SecretText outside of the location it is actually being used.
There was a problem hiding this comment.
Move the logic to the procedure with secret text and have the other procedure call it, so you dont have to duplicate the code.
There was a problem hiding this comment.
Remember to do the same for other procedures.
|
@darjoo , @WaelAbuSeada The way they would do it is to simply write a brute force search comparing the secret text with different combinations and then adding a breakpoint inside an if statement chrcking if the password matches. |
| begin | ||
| exit(GenerateHash(InputString.Unwrap(), Key, HashAlgorithmType)); | ||
| end; | ||
|
|
||
| [NonDebuggable] | ||
| procedure GenerateHash(InputString: Text; "Key": SecretText; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text |
There was a problem hiding this comment.
Move the logic to the procedure with secret text and have the other procedure call it, so you dont have to duplicate the code.
| begin | ||
| exit(GenerateHash(InputString.Unwrap(), Key, HashAlgorithmType)); | ||
| end; | ||
|
|
||
| [NonDebuggable] | ||
| procedure GenerateHash(InputString: Text; "Key": SecretText; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text |
There was a problem hiding this comment.
Remember to do the same for other procedures.
@TKaptian Could you let us know the scenarios you have that require this? What type of values are in the secrettext and why that needs to be hashed? |
JesperSchulz
added
the
Follow Up
|
@darjoo there's an thread on yammer about this topic: I think one good example is to use this for Basic Authentication that requires a Base64 hash. I know that there exists better authentication methods than base64 but sometimes we aren't in the control of the external service and the external service only provides simple authentication methods. |
Summary
New overloaded procedures for Hash and Sign/Verify that accept SecretText value as hash/sign input value.
Work Item(s)
Fixes #736
Fixes AB#507370