From d103ed6ca97ca5a2669f6cf5fe4b3d2a9c945f26 Mon Sep 17 00:00:00 2001 From: Christopher Speller Date: Wed, 17 May 2017 16:51:25 -0400 Subject: Upgrading server dependancies (#6431) --- vendor/golang.org/x/net/xsrftoken/xsrf.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'vendor/golang.org/x/net/xsrftoken') diff --git a/vendor/golang.org/x/net/xsrftoken/xsrf.go b/vendor/golang.org/x/net/xsrftoken/xsrf.go index 881bf199f..bc861e1f3 100644 --- a/vendor/golang.org/x/net/xsrftoken/xsrf.go +++ b/vendor/golang.org/x/net/xsrftoken/xsrf.go @@ -27,15 +27,18 @@ func clean(s string) string { // Generate returns a URL-safe secure XSRF token that expires in 24 hours. // -// key is a secret key for your application. -// userID is a unique identifier for the user. -// actionID is the action the user is taking (e.g. POSTing to a particular path). +// key is a secret key for your application; it must be non-empty. +// userID is an optional unique identifier for the user. +// actionID is an optional action the user is taking (e.g. POSTing to a particular path). func Generate(key, userID, actionID string) string { return generateTokenAtTime(key, userID, actionID, time.Now()) } // generateTokenAtTime is like Generate, but returns a token that expires 24 hours from now. func generateTokenAtTime(key, userID, actionID string, now time.Time) string { + if len(key) == 0 { + panic("zero length xsrf secret key") + } // Round time up and convert to milliseconds. milliTime := (now.UnixNano() + 1e6 - 1) / 1e6 @@ -57,6 +60,9 @@ func Valid(token, key, userID, actionID string) bool { // validTokenAtTime reports whether a token is valid at the given time. func validTokenAtTime(token, key, userID, actionID string, now time.Time) bool { + if len(key) == 0 { + panic("zero length xsrf secret key") + } // Extract the issue time of the token. sep := strings.LastIndex(token, ":") if sep < 0 { -- cgit v1.2.3-1-g7c22