Add unicode support to htpasswd

radicale/auth/htpasswd.py

@@ -59,6 +59,7 @@ class Auth(auth.BaseAuth):
     def __init__(self, configuration):
         super().__init__(configuration)
         self._filename = configuration.get("auth", "htpasswd_filename")
+        self._encoding = self.configuration.get("encoding", "stock")
         encryption = configuration.get("auth", "htpasswd_encryption")
 
         if encryption == "plain":
@@ -83,7 +84,7 @@ class Auth(auth.BaseAuth):
 
     def _plain(self, hash_value, password):
         """Check if ``hash_value`` and ``password`` match, plain method."""
-        return hmac.compare_digest(hash_value, password)
+        return hmac.compare_digest(hash_value.encode(), password.encode())
 
     def _bcrypt(self, bcrypt, hash_value, password):
         return bcrypt.verify(password, hash_value.strip())
@@ -104,7 +105,7 @@ class Auth(auth.BaseAuth):
 
         """
         try:
-            with open(self._filename) as f:
+            with open(self._filename, encoding=self._encoding) as f:
                 for line in f:
                     line = line.rstrip("\n")
                     if line.lstrip() and not line.lstrip().startswith("#"):
@@ -113,7 +114,8 @@ class Auth(auth.BaseAuth):
                                 ":", maxsplit=1)
                             # Always compare both login and password to avoid
                             # timing attacks, see #591.
-                            login_ok = hmac.compare_digest(hash_login, login)
+                            login_ok = hmac.compare_digest(
+                                hash_login.encode(), login.encode())
                             password_ok = self._verify(hash_value, password)
                             if login_ok and password_ok:
                                 return login

radicale/tests/test_auth.py

@@ -52,38 +52,11 @@ class TestBaseAuthRequests(BaseTest):
         shutil.rmtree(self.colpath)
 
     def _test_htpasswd(self, htpasswd_encryption, htpasswd_content,
-                       test_matrix=None):
+                       test_matrix="ascii"):
-        """Test htpasswd authentication with user "tmp" and password "bepo"."""
+        """Test htpasswd authentication with user "tmp" and password "bepo" for
-        htpasswd_file_path = os.path.join(self.colpath, ".htpasswd")
+           ``test_matrix`` "ascii" or user "😀" and password "🔑" for
-        with open(htpasswd_file_path, "w") as f:
+           ``test_matrix`` "unicode"."""
-            f.write(htpasswd_content)
+        if htpasswd_encryption == "bcrypt":
-        self.configuration.update({
-            "auth": {"type": "htpasswd",
-                     "htpasswd_filename": htpasswd_file_path,
-                     "htpasswd_encryption": htpasswd_encryption}}, "test")
-        self.application = Application(self.configuration)
-        if test_matrix is None:
-            test_matrix = (
-                ("tmp", "bepo", 207), ("tmp", "tmp", 401), ("tmp", "", 401),
-                ("unk", "unk", 401), ("unk", "", 401), ("", "", 401))
-        for user, password, expected_status in test_matrix:
-            status, _, _ = self.request(
-                "PROPFIND", "/",
-                HTTP_AUTHORIZATION="Basic %s" % base64.b64encode(
-                    ("%s:%s" % (user, password)).encode()).decode())
-            assert status == expected_status
-
-    def test_htpasswd_plain(self):
-        self._test_htpasswd("plain", "tmp:bepo")
-
-    def test_htpasswd_plain_password_split(self):
-        self._test_htpasswd("plain", "tmp:be:po", (
-            ("tmp", "be:po", 207), ("tmp", "bepo", 401)))
-
-    def test_htpasswd_md5(self):
-        self._test_htpasswd("md5", "tmp:$apr1$BI7VKCZh$GKW4vq2hqDINMr8uv7lDY/")
-
-    def test_htpasswd_bcrypt(self):
             try:
                 from passlib.hash import bcrypt
                 from passlib.exc import MissingBackendError
@@ -93,9 +66,54 @@ class TestBaseAuthRequests(BaseTest):
                 bcrypt.hash("test-bcrypt-backend")
             except MissingBackendError:
                 pytest.skip("bcrypt backend for passlib is not installed")
+        htpasswd_file_path = os.path.join(self.colpath, ".htpasswd")
+        encoding = self.configuration.get("encoding", "stock")
+        with open(htpasswd_file_path, "w", encoding=encoding) as f:
+            f.write(htpasswd_content)
+        self.configuration.update({
+            "auth": {"type": "htpasswd",
+                     "htpasswd_filename": htpasswd_file_path,
+                     "htpasswd_encryption": htpasswd_encryption}}, "test")
+        self.application = Application(self.configuration)
+        if test_matrix == "ascii":
+            test_matrix = (("tmp", "bepo", True), ("tmp", "tmp", False),
+                           ("tmp", "", False), ("unk", "unk", False),
+                           ("unk", "", False), ("", "", False))
+        elif test_matrix == "unicode":
+            test_matrix = (("😀", "🔑", True), ("😀", "🌹", False),
+                           ("😁", "🔑", False), ("😀", "", False),
+                           ("", "🔑", False), ("", "", False))
+        for user, password, valid in test_matrix:
+            status, _, _ = self.request(
+                "PROPFIND", "/",
+                HTTP_AUTHORIZATION="Basic %s" % base64.b64encode(
+                    ("%s:%s" % (user, password)).encode()).decode())
+            assert status == (207 if valid else 401)
+
+    def test_htpasswd_plain(self):
+        self._test_htpasswd("plain", "tmp:bepo")
+
+    def test_htpasswd_plain_password_split(self):
+        self._test_htpasswd("plain", "tmp:be:po", (
+            ("tmp", "be:po", True), ("tmp", "bepo", False)))
+
+    def test_htpasswd_plain_unicode(self):
+        self._test_htpasswd("plain", "😀:🔑", "unicode")
+
+    def test_htpasswd_md5(self):
+        self._test_htpasswd("md5", "tmp:$apr1$BI7VKCZh$GKW4vq2hqDINMr8uv7lDY/")
+
+    def test_htpasswd_md5_unicode(self):
         self._test_htpasswd(
-            "bcrypt",
+            "md5", "😀:$apr1$w4ev89r1$29xO8EvJmS2HEAadQ5qy11", "unicode")
-            "tmp:$2y$05$oD7hbiQFQlvCM7zoalo/T.MssV3VNTRI3w5KDnj8NTUKJNWfVpvRq")
+
+    def test_htpasswd_bcrypt(self):
+        self._test_htpasswd("bcrypt", "tmp:$2y$05$oD7hbiQFQlvCM7zoalo/T.MssV3V"
+                            "NTRI3w5KDnj8NTUKJNWfVpvRq")
+
+    def test_htpasswd_bcrypt_unicode(self):
+        self._test_htpasswd("bcrypt", "😀:$2y$10$Oyz5aHV4MD9eQJbk6GPemOs4T6edK"
+                            "6U9Sqlzr.W1mMVCS8wJUftnW", "unicode")
 
     def test_htpasswd_multi(self):
         self._test_htpasswd("plain", "ign:ign\ntmp:bepo")
@@ -105,12 +123,12 @@ class TestBaseAuthRequests(BaseTest):
     def test_htpasswd_whitespace_user(self):
         for user in (" tmp", "tmp ", " tmp "):
             self._test_htpasswd("plain", "%s:bepo" % user, (
-                (user, "bepo", 207), ("tmp", "bepo", 401)))
+                (user, "bepo", True), ("tmp", "bepo", False)))
 
     def test_htpasswd_whitespace_password(self):
         for password in (" bepo", "bepo ", " bepo "):
             self._test_htpasswd("plain", "tmp:%s" % password, (
-                ("tmp", password, 207), ("tmp", "bepo", 401)))
+                ("tmp", password, True), ("tmp", "bepo", False)))
 
     def test_htpasswd_comment(self):
         self._test_htpasswd("plain", "#comment\n #comment\n \ntmp:bepo\n\n")