wdevs/relspecgo
5
1
Fork 0
Code Issues 3 Pull Requests 1 Actions Packages Releases 87 Wiki Activity

chore(deps): update all dependencies

Browse Source 
Fixes GO-2026-6629 (golang.org/x/text precis panic). Bumps bun and
bun/dialect/pgdialect together to v1.3.0; go directive now 1.26.0.
This commit is contained in:
Hein
2026-10-12 09:31:55 +02:00
parent a4c68e5661
commit 337af294f3
795 changed files with 1386055 additions and 4172378 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vendor/github.com/jackc/pgx/v5/pgconn/auth_scram.go
Generated Vendored
+11 -3
View File
@@ -229,11 +229,12 @@ func (sc *scramClient) clientFirstMessage() []byte {
sc.clientFirstMessageBare = fmt.Appendf(nil, "n=,r=%s", sc.clientNonce)
if sc.authMechanism == scramSHA256PlusName {
switch {
case sc.authMechanism == scramSHA256PlusName:
sc.clientGS2Header = []byte("p=tls-server-end-point,,")
} else if sc.hasTLS {
case sc.hasTLS:
sc.clientGS2Header = []byte("y,,")
} else {
default:
sc.clientGS2Header = []byte("n,,")
}
@@ -283,6 +284,13 @@ func (sc *scramClient) recvServerFirstMessage(serverFirstMessage []byte) error {
if err != nil || sc.iterations <= 0 {
return fmt.Errorf("invalid SCRAM iteration count received from server: %w", err)
}
// Bound server-supplied iteration count to prevent a malicious server from forcing the client
// to spend unbounded CPU in PBKDF2. PostgreSQL's scram_iterations defaults to 4096; this ceiling
// is ~2500x that.
const maxScramIterations = 10_000_000
if sc.iterations > maxScramIterations {
return fmt.Errorf("SCRAM iteration count from server too high: %d (max %d)", sc.iterations, maxScramIterations)
}
if !bytes.HasPrefix(sc.clientAndServerNonce, sc.clientNonce) {
return errors.New("invalid SCRAM nonce: did not start with client nonce")