fix: ensure new passwords are distinct

hushline/forms.py

@@ -1,10 +1,16 @@
 import re
+from hmac import compare_digest as bytes_are_equal
+from typing import Callable
 
 from flask_wtf import FlaskForm
 from wtforms import Field, Form, StringField
 from wtforms.validators import DataRequired, Length, ValidationError
 
 
+class WrongPassword(ValueError):
+    pass
+
+
 class ComplexPassword:
     def __init__(self, message: str | None = None) -> None:
         if not message:
@@ -25,5 +31,15 @@ def __call__(self, form: Form, field: Field) -> None:
             raise ValidationError(self.message)
 
 
+def is_valid_password_swap(
+    *, check_password: Callable[[str], bool], old_password: str, new_password: str
+) -> bool:
+    # since the passwords can be of different lengths, the equality test must occur *iif*
+    # the correctness test passes, since timing differences leak length information
+    if check_password(old_password):
+        return not bytes_are_equal(old_password.encode(), new_password.encode())
+    raise WrongPassword
+
+
 class TwoFactorForm(FlaskForm):
     verification_code = StringField("2FA Code", validators=[DataRequired(), Length(min=6, max=6)])

hushline/settings.py

@@ -21,7 +21,7 @@
 
 from .crypto import is_valid_pgp_key
 from .db import db
-from .forms import ComplexPassword, TwoFactorForm
+from .forms import ComplexPassword, TwoFactorForm, WrongPassword, is_valid_password_swap
 from .model import Message, SecondaryUsername, User
 from .utils import require_2fa
 
@@ -176,12 +176,20 @@ def index() -> str | Response:  # noqa: PLR0911, PLR0912
 
             # Handle Change Password Form Submission
             if change_password_form.validate_on_submit():
-                if user.check_password(change_password_form.old_password.data):
-                    user.password_hash = change_password_form.new_password.data
-                    db.session.commit()
-                    flash("👍 Password changed successfully.")
-                else:
-                    flash("⛔️ Incorrect old password.")
+                try:
+                    if is_valid_password_swap(
+                        check_password=user.check_password,
+                        old_password=change_password_form.old_password.data,
+                        new_password=change_password_form.new_password.data,
+                    ):
+                        user.password_hash = change_password_form.new_password.data
+                        db.session.commit()
+                        flash("👍 Password successfully changed. Please log in again.", "success")
+                        # Redirect to the login page for re-authentication
+                        return redirect(url_for("login"))
+                    flash("⛔️ New password is invalid.", "error")
+                except WrongPassword:
+                    flash("⛔️ Incorrect old password.", "error")
                 return redirect(url_for("settings"))
 
             # Check if user is admin and add admin-specific data
@@ -254,25 +262,25 @@ def change_password() -> str | Response:
             flash("User not found.", "error")
             return redirect(url_for("login"))
 
-        change_password_form = ChangePasswordForm(request.form)
-        if not change_password_form.validate_on_submit():
-            flash("New password is invalid.")
-            return redirect(url_for("settings.index"))
-
-        # Verify the old password
-        if not user.check_password(change_password_form.old_password.data):
-            flash("Incorrect old password.", "error")
-            return redirect(url_for("settings.index"))
-
-        # Set the new password
-        user.password_hash = change_password_form.new_password.data
-        db.session.commit()
-        session.clear()  # Clears the session, logging the user out
-        flash(
-            "👍 Password successfully changed. Please log in again.",
-            "success",
-        )
-        return redirect(url_for("login"))  # Redirect to the login page for re-authentication
+        # Validate the password swap
+        try:
+            change_password_form = ChangePasswordForm(request.form)
+            if change_password_form.validate_on_submit() and is_valid_password_swap(
+                check_password=user.check_password,
+                old_password=change_password_form.old_password.data,
+                new_password=change_password_form.new_password.data,
+            ):
+                # Set the new password
+                user.password_hash = change_password_form.new_password.data
+                db.session.commit()
+                session.clear()  # Clears the session, logging the user out
+                flash("👍 Password successfully changed. Please log in again.", "success")
+                # Redirect to the login page for re-authentication
+                return redirect(url_for("login"))
+            flash("⛔️ New password is invalid.", "error")
+        except WrongPassword:
+            flash("⛔️ Incorrect old password.", "error")
+        return redirect(url_for("settings.index"))
 
     @bp.route("/change-username", methods=["POST"])
     @require_2fa

tests/test_settings.py

@@ -110,6 +110,20 @@ def test_change_password(client: FlaskClient) -> None:
     assert logged_in_user is not None
     assert user.id == logged_in_user.id
 
+    # Submit POST request to verify new password must be distinct from the previous
+    response = client.post(
+        "/settings/change-password",
+        data={
+            "old_password": original_password,
+            "new_password": original_password,
+        },
+        follow_redirects=True,
+    )
+    assert response.status_code == 200
+    assert "settings" in response.request.url
+    assert b"New password is invalid" in response.data
+    assert b"Password successfully changed" not in response.data
+
     # Submit POST request to change the username & verify update was successful
     response = client.post(
         "/settings/change-password",