{% if show_date %}
| {{ t.timestamp|format_datetime }} |
{% else %}
@@ -37,7 +37,7 @@
{% endif %}
-
+
{% trans %}Download{% endtrans %}
|
@@ -52,7 +52,7 @@
{% trans %}N/A{% endtrans %}
{% else %}
-
+
{% trans %}Download{% endtrans %}
{% endif %}
@@ -70,7 +70,7 @@
{% elif files|length == 1 %}
{% set filename = next(iter(t.files.keys())) %}
{% set real_filename = filename|replace(".%l", (t.language|to_language).source_extension) %}
-
+
{% trans %}Download{% endtrans %}
{% else %}
@@ -87,7 +87,7 @@
{% set real_filename = filename %}
{% endif %}
-
+
{{ real_filename }}
diff --git a/cmscommon/crypto.py b/cmscommon/crypto.py
index f90cb00352..c6fce0db6f 100644
--- a/cmscommon/crypto.py
+++ b/cmscommon/crypto.py
@@ -22,24 +22,16 @@
"""Utilities dealing with encryption and randomness."""
-import binascii
import hmac
-import random
+import secrets
from string import ascii_lowercase
import bcrypt
-from Cryptodome import Random
-from Cryptodome.Cipher import AES
-
-from cmscommon.binary import bin_to_hex, hex_to_bin, bin_to_b64, b64_to_bin
__all__ = [
"get_random_key", "get_hex_random_key",
- "encrypt_binary", "decrypt_binary",
- "encrypt_number", "decrypt_number",
-
"generate_random_password",
"validate_password", "build_password", "hash_password",
@@ -47,8 +39,6 @@
]
-_RANDOM = Random.new()
-
# bcrypt difficulty parameter. This is here so that it can be set to a lower
# value when running unit tests. It seems that the lowest accepted value is 4.
BCRYPT_ROUNDS = 12
@@ -57,7 +47,7 @@ def get_random_key() -> bytes:
"""Generate 16 random bytes, safe to be used as AES key.
"""
- return _RANDOM.read(16)
+ return secrets.token_bytes(16)
def get_hex_random_key() -> str:
@@ -65,88 +55,7 @@ def get_hex_random_key() -> str:
Return it encoded in hexadecimal.
"""
- return bin_to_hex(get_random_key())
-
-
-def encrypt_binary(pt: bytes, key_hex: str) -> str:
- """Encrypt the plaintext with the 16-bytes key.
-
- A random salt is added to avoid having the same input being
- encrypted to the same output.
-
- pt: the "plaintext" to encode.
- key_hex: a 16-bytes key in hex (a string of 32 hex chars).
-
- return: pt encrypted using the key, in a format URL-safe
- (more precisely, base64-encoded with alphabet "a-zA-Z0-9.-_").
-
- """
- key = hex_to_bin(key_hex)
- # Pad the plaintext to make its length become a multiple of the block size
- # (that is, for AES, 16 bytes), using a byte 0x01 followed by as many bytes
- # 0x00 as needed. If the length of the message is already a multiple of 16
- # bytes, add a new block.
- pt_pad = pt + b'\01' + b'\00' * (16 - (len(pt) + 1) % 16)
- # The IV is a random block used to differentiate messages encrypted with
- # the same key. An IV should never be used more than once in the lifetime
- # of the key. In this way encrypting the same plaintext twice will produce
- # different ciphertexts.
- iv = get_random_key()
- # Initialize the AES cipher with the given key and IV.
- aes = AES.new(key, AES.MODE_CBC, iv)
- ct = aes.encrypt(pt_pad)
- # Convert the ciphertext in a URL-safe base64 encoding
- ct_b64 = bin_to_b64(iv + ct)\
- .replace('+', '-').replace('/', '_').replace('=', '.')
- return ct_b64
-
-
-def decrypt_binary(ct_b64: str, key_hex: str) -> bytes:
- """Decrypt a ciphertext generated by encrypt_binary.
-
- ct_b64: the ciphertext as produced by encrypt_binary.
- key_hex: the 16-bytes key in hex format used to encrypt.
-
- return: the plaintext.
-
- raise (ValueError): if the ciphertext is invalid.
-
- """
- key = hex_to_bin(key_hex)
- try:
- # Convert the ciphertext from a URL-safe base64 encoding to a
- # bytestring, which contains both the IV (the first 16 bytes) as well
- # as the encrypted padded plaintext.
- iv_ct = b64_to_bin(
- ct_b64.replace('-', '+').replace('_', '/').replace('.', '='))
- aes = AES.new(key, AES.MODE_CBC, iv_ct[:16])
- # Get the padded plaintext.
- pt_pad = aes.decrypt(iv_ct[16:])
- # Remove the padding.
- # TODO check that the padding is correct, i.e. that it contains at most
- # 15 bytes 0x00 preceded by a byte 0x01.
- pt = pt_pad.rstrip(b'\x00')[:-1]
- return pt
- except (TypeError, binascii.Error):
- raise ValueError('Could not decode from base64.')
- except ValueError:
- raise ValueError('Wrong AES cryptogram length.')
-
-
-def encrypt_number(num: int, key_hex: str) -> str:
- """Encrypt an integer number, with the same properties as
- encrypt_binary().
-
- """
- hexnum = b"%x" % num
- return encrypt_binary(hexnum, key_hex)
-
-
-def decrypt_number(enc: str, key_hex: str) -> int:
- """Decrypt an integer number encrypted with encrypt_number().
-
- """
- return int(decrypt_binary(enc, key_hex), 16)
+ return get_random_key().hex()
def generate_random_password() -> str:
@@ -155,7 +64,7 @@ def generate_random_password() -> str:
return: a random string.
"""
- return "".join((random.choice(ascii_lowercase) for _ in range(6)))
+ return "".join((secrets.choice(ascii_lowercase) for _ in range(6)))
def parse_authentication(authentication: str) -> tuple[str, str]:
diff --git a/cmscommon/digest.py b/cmscommon/digest.py
index 49e58386a5..b3ff95ca14 100644
--- a/cmscommon/digest.py
+++ b/cmscommon/digest.py
@@ -19,8 +19,6 @@
import hashlib
import io
-from cmscommon.binary import bin_to_hex
-
__all__ = [
"Digester", "bytes_digest", "path_digest"
@@ -39,7 +37,7 @@ def update(self, b: bytes):
def digest(self) -> str:
"""Return the digest as an hex string."""
- return bin_to_hex(self._hasher.digest())
+ return self._hasher.digest().hex()
def bytes_digest(b: bytes) -> str:
diff --git a/cmscontrib/AddSubmission.py b/cmscontrib/AddSubmission.py
index 9c6a54244b..a85921caef 100755
--- a/cmscontrib/AddSubmission.py
+++ b/cmscontrib/AddSubmission.py
@@ -28,6 +28,7 @@
from cms.db import File, Participation, SessionGen, Submission, Task, User, \
ask_for_contest
from cms.db.filecacher import FileCacher
+from cms.db.util import generate_opaque_id
from cms.grading.language import Language
from cms.grading.languagemanager import filename_to_language, get_language
from cms.io import RemoteServiceClient
@@ -160,7 +161,7 @@ def add_submission(
language=language_name,
participation=participation,
task=task,
- opaque_id=Submission.generate_opaque_id(session, participation.id)
+ opaque_id=generate_opaque_id(Submission, session, participation.id)
)
for filename, digest in file_digests.items():
session.add(File(filename, digest, submission=submission))
diff --git a/cmscommon/binary.py b/cmscontrib/updaters/update_47.py
similarity index 52%
rename from cmscommon/binary.py
rename to cmscontrib/updaters/update_47.py
index 7cf7c02b91..16eaf55c80 100644
--- a/cmscommon/binary.py
+++ b/cmscontrib/updaters/update_47.py
@@ -1,8 +1,7 @@
#!/usr/bin/env python3
# Contest Management System - http://cms-dev.github.io/
-# Copyright © 2018 Luca Wehrstedt
-# Copyright © 2018 Stefano Maggiolo
+# Copyright © 2025 Luca Versari
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
@@ -17,25 +16,33 @@
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see .
-import binascii
+"""A class to update a dump created by CMS.
+Used by DumpImporter and DumpUpdater.
-__all__ = [
- "bin_to_hex", "hex_to_bin", "bin_to_b64", "b64_to_bin",
-]
+Adds opaque_id to user tests.
+"""
-def bin_to_hex(bin: bytes) -> str:
- return binascii.b2a_hex(bin).decode('ascii')
+import random
-def hex_to_bin(hex: str) -> bytes:
- return binascii.a2b_hex(hex.encode('ascii'))
+class Updater:
-def bin_to_b64(bin: bytes) -> str:
- return binascii.b2a_base64(bin, newline=False).decode('ascii')
+ def __init__(self, data):
+ assert data["_version"] == 46
+ self.objs = data
+ def run(self):
+ used_ids = set()
+ for k, v in self.objs.items():
+ if k.startswith("_"):
+ continue
+ if v["_class"] == "UserTest":
+ while "opaque_id" not in v or v["opaque_id"] in used_ids:
+ v["opaque_id"] = random.randint(0, 2**63-1)
+ used_ids.add(v["opaque_id"])
+
+ return self.objs
-def b64_to_bin(b64: str) -> bytes:
- return binascii.a2b_base64(b64.encode('ascii'))
diff --git a/cmscontrib/updaters/update_from_1.5.sql b/cmscontrib/updaters/update_from_1.5.sql
index a1ff578498..38f456d6a4 100644
--- a/cmscontrib/updaters/update_from_1.5.sql
+++ b/cmscontrib/updaters/update_from_1.5.sql
@@ -45,4 +45,10 @@ ALTER TABLE user_test_results DROP COLUMN evaluation_sandbox;
-- https://github.com/cms-dev/cms/pull/1486
ALTER TABLE public.tasks ADD COLUMN allowed_languages varchar[];
+-- https://github.com/cms-dev/cms/pull/1526
+ALTER TABLE user_tests ADD COLUMN opaque_id BIGINT;
+UPDATE user_tests SET opaque_id = id WHERE opaque_id IS NULL;
+ALTER TABLE user_tests ADD CONSTRAINT user_tests_participation_id_opaque_id_key UNIQUE (participation_id, opaque_id);
+ALTER TABLE user_tests ALTER COLUMN opaque_id SET NOT NULL;
+
COMMIT;
diff --git a/cmstestsuite/unit_tests/cmscommon/binary_test.py b/cmstestsuite/unit_tests/cmscommon/binary_test.py
deleted file mode 100755
index b51e0f41ae..0000000000
--- a/cmstestsuite/unit_tests/cmscommon/binary_test.py
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-
-# Contest Management System - http://cms-dev.github.io/
-# Copyright © 2018 Stefano Maggiolo
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program. If not, see .
-
-"""Tests for the binary module"""
-
-import binascii
-import unittest
-
-from cmscommon.binary import bin_to_hex, hex_to_bin, bin_to_b64, b64_to_bin
-
-
-class TestBinToHex(unittest.TestCase):
-
- def test_success(self):
- self.assertEqual(bin_to_hex(b"\x32\x00\xa0"), "3200a0")
- self.assertEqual(bin_to_hex(b"\xFF\xFF\xFF\xFF"), "ffffffff")
- self.assertEqual(bin_to_hex(b"\x00" * 1000), "0" * 2000)
-
- def test_string(self):
- with self.assertRaises(TypeError):
- bin_to_hex("cms")
-
-
-class TestHexToBin(unittest.TestCase):
-
- def setUp(self):
- super().setUp()
- # The exception type depend on Python's version.
- self.error = binascii.Error
-
- def test_success(self):
- self.assertEqual(hex_to_bin("3200a0"), b"\x32\x00\xa0")
- self.assertEqual(hex_to_bin("ffffffff"), b"\xFF\xFF\xFF\xFF")
- self.assertEqual(hex_to_bin("0" * 2000), b"\x00" * 1000)
-
- def test_invalid_length(self):
- with self.assertRaises(self.error):
- hex_to_bin("000")
-
- def test_invalid_alphabet(self):
- with self.assertRaises(self.error):
- hex_to_bin("cmscms")
-
-
-class TestBinToB64(unittest.TestCase):
-
- def test_success(self):
- self.assertEqual(bin_to_b64(b"\x32\x00\xa0"), "MgCg")
- self.assertEqual(bin_to_b64(b"\xFF\xFF\xFF\xFF"), "/////w==")
- self.assertEqual(bin_to_b64(b"\x00" * 3000), "A" * (3000 * 4 // 3))
-
- def test_string(self):
- with self.assertRaises(TypeError):
- bin_to_b64("cms")
-
-
-class TestB64ToBin(unittest.TestCase):
-
- def test_success(self):
- self.assertEqual(b64_to_bin("MgCg"), b"\x32\x00\xa0")
- self.assertEqual(b64_to_bin("/////w=="), b"\xFF\xFF\xFF\xFF")
- self.assertEqual(b64_to_bin("A" * (3000 * 4 // 3)), b"\x00" * 3000)
-
- def test_invalid_length(self):
- with self.assertRaises(binascii.Error):
- b64_to_bin("MgC")
-
- def test_invalid_alphabet(self):
- # binascii ignores invalid characters
- self.assertEqual(b64_to_bin("M\x00g.C,g\x0a"), b"\x32\x00\xa0")
-
-
-if __name__ == "__main__":
- unittest.main()
diff --git a/cmstestsuite/unit_tests/cmscommon/crypto_test.py b/cmstestsuite/unit_tests/cmscommon/crypto_test.py
index bd280e6a9d..9ea79da157 100755
--- a/cmstestsuite/unit_tests/cmscommon/crypto_test.py
+++ b/cmstestsuite/unit_tests/cmscommon/crypto_test.py
@@ -18,12 +18,9 @@
"""Tests for the crypto module"""
-import re
import unittest
-from cmscommon.binary import bin_to_b64
from cmscommon.crypto import build_password, \
- decrypt_binary, decrypt_number, encrypt_binary, encrypt_number, \
generate_random_password, get_hex_random_key, get_random_key, \
hash_password, parse_authentication, validate_password
@@ -47,76 +44,6 @@ def test_length(self):
self.assertEqual(len(get_hex_random_key()), 32)
-class TestEncryptAndDecryptBinary(unittest.TestCase):
- """Tests for the functions encrypt_binary and decrypt_binary."""
-
- def setUp(self):
- super().setUp()
- self.key = get_hex_random_key()
-
- def test_encrypt_and_decrypt(self):
- self.assertEqual(
- decrypt_binary(encrypt_binary(b"stuff", self.key), self.key),
- b"stuff")
-
- def test_encrypt_and_decrypt_empty(self):
- self.assertEqual(
- decrypt_binary(encrypt_binary(b"", self.key), self.key),
- b"")
-
- def test_encrypt_and_decrypt_long(self):
- value = b"0" * 1_000_000
- self.assertEqual(
- decrypt_binary(encrypt_binary(value, self.key), self.key),
- value)
-
- def test_encrypt_chaining(self):
- # Even if the input is repeated, the output should not be.
- encrypted = encrypt_binary(b"0" * 1_000_000, self.key)
- # The output should appear random, so any sequence of 64 bytes is
- # very unlikely to repeat.
- blocks = re.findall(".{64}", encrypted)
- self.assertEqual(len(blocks), len(set(blocks)))
-
- def test_encrypt_salting(self):
- self.assertNotEqual(encrypt_binary(b"stuff", self.key),
- encrypt_binary(b"stuff", self.key))
-
- def test_decrypt_invalid_base64(self):
- encrypted = encrypt_binary(b"stuff", self.key)
- with self.assertRaises(ValueError):
- decrypt_binary(encrypted[1:], self.key)
-
- def test_decrypt_invalid_encrypted(self):
- # "stuff" is not decryptable.
- encrypted = bin_to_b64(b"stuff")
- with self.assertRaises(ValueError):
- decrypt_binary(encrypted, self.key)
-
-
-class TestEncryptAndDecryptNumber(unittest.TestCase):
- """Tests for the functions encrypt_number and decrypt_number."""
-
- def setUp(self):
- super().setUp()
- self.key = get_hex_random_key()
-
- def test_encrypt_and_decrypt(self):
- self.assertEqual(
- decrypt_number(encrypt_number(123, self.key), self.key),
- 123)
-
- def test_encrypt_and_decrypt_negative(self):
- self.assertEqual(
- decrypt_number(encrypt_number(-123, self.key), self.key),
- -123)
-
- def test_encrypt_and_decrypt_big(self):
- self.assertEqual(
- decrypt_number(encrypt_number(10 ** 42, self.key), self.key),
- 10 ** 42)
-
-
class TestGenerateRandomPassword(unittest.TestCase):
"""Tests for the function generate_random_password."""
diff --git a/cmstestsuite/unit_tests/cmscontrib/DumpImporterTest.py b/cmstestsuite/unit_tests/cmscontrib/DumpImporterTest.py
index 1c1c237cf8..57e7c39bf7 100755
--- a/cmstestsuite/unit_tests/cmscontrib/DumpImporterTest.py
+++ b/cmstestsuite/unit_tests/cmscontrib/DumpImporterTest.py
@@ -359,6 +359,7 @@ def test_import_old(self):
"preferred_languages": "[\"en\", \"it_IT\"]",
"contest": "contest_key",
"submissions": ["sub1_key", "sub2_key"],
+ "user_tests": ["ut_key"],
},
"sub1_key": {
"_class": "Submission",
@@ -382,6 +383,17 @@ def test_import_old(self):
"executables": {},
"evaluations": [],
},
+ "ut_key": {
+ "_class": "UserTest",
+ "timestamp": 1_234_567_900.123,
+ "language": "c",
+ "user": "user_key",
+ "task": "task_key",
+ "files": {},
+ "managers": {},
+ "input": TestDumpImporter.NON_GENERATED_FILE_DIGEST,
+ "results": []
+ },
"exe_key": {
"_class": "Executable",
"submission": "sub1_key",
diff --git a/cmstestsuite/unit_tests/databasemixin.py b/cmstestsuite/unit_tests/databasemixin.py
index f24c7b6e14..255488dc2c 100644
--- a/cmstestsuite/unit_tests/databasemixin.py
+++ b/cmstestsuite/unit_tests/databasemixin.py
@@ -456,6 +456,7 @@ def add_user_test(self, task=None, participation=None, **kwargs):
"participation": participation,
"input": unique_digest(),
"timestamp": (task.contest.start + timedelta(0, unique_long_id())),
+ "opaque_id": unique_long_id(),
}
args.update(kwargs)
user_test = UserTest(**args)
diff --git a/cmstestsuite/web/AWSRequests.py b/cmstestsuite/web/AWSRequests.py
index 990cc94ba5..9bcaea70f8 100644
--- a/cmstestsuite/web/AWSRequests.py
+++ b/cmstestsuite/web/AWSRequests.py
@@ -48,7 +48,7 @@ class AWSSubmissionViewRequest(GenericRequest):
def __init__(self, browser, submission_id, base_url=None):
GenericRequest.__init__(self, browser, base_url)
self.submission_id = submission_id
- self.url = "%s/submission/%s" % (self.base_url, submission_id)
+ self.url = "%s/submission/opaque_%s" % (self.base_url, submission_id)
def describe(self):
return "check submission %s" % self.submission_id
@@ -105,7 +105,7 @@ class AWSUserTestViewRequest(GenericRequest):
def __init__(self, browser, user_test_id, base_url=None):
GenericRequest.__init__(self, browser, base_url)
self.user_test_id = user_test_id
- self.url = "%s/user_test/%s" % (self.base_url, user_test_id)
+ self.url = "%s/user_test/opaque_%s" % (self.base_url, user_test_id)
def describe(self):
return "check user_test %s" % self.user_test_id
diff --git a/cmstestsuite/web/CWSRequests.py b/cmstestsuite/web/CWSRequests.py
index 6c68ee7a0e..8aab8ff1e2 100644
--- a/cmstestsuite/web/CWSRequests.py
+++ b/cmstestsuite/web/CWSRequests.py
@@ -28,9 +28,7 @@
import tempfile
from urllib.parse import parse_qs, urlsplit
-from cms import config
from cms.grading.languagemanager import filename_to_language
-from cmscommon.crypto import decrypt_number
from cmstestsuite.web import GenericRequest, LoginRequest
@@ -160,13 +158,7 @@ def get_submission_id(self):
logger.warning("Redirected to an unexpected page: `%s'",
self.redirected_to)
return None
- try:
- submission_id = decrypt_number(query["submission_id"][0],
- config.web_server.secret_key)
- except Exception:
- logger.warning("Unable to decrypt submission id from page: `%s'",
- self.redirected_to)
- return None
+ submission_id = int(query["submission_id"][0])
return submission_id
@@ -227,13 +219,7 @@ def get_user_test_id(self):
logger.warning("Redirected to an unexpected page: `%s'",
self.redirected_to)
return None
- try:
- user_test_id = decrypt_number(query["user_test_id"][0],
- config.web_server.secret_key)
- except Exception:
- logger.warning("Unable to decrypt user test id from page: `%s'",
- self.redirected_to)
- return None
+ user_test_id = int(query["user_test_id"][0])
return user_test_id
diff --git a/constraints.txt b/constraints.txt
index 4f1f7ced2f..ecfc8a36c5 100644
--- a/constraints.txt
+++ b/constraints.txt
@@ -26,7 +26,6 @@ pluggy==1.6.0
prometheus_client==0.21.1
psutil==7.0.0
psycopg2==2.9.10
-pycryptodomex==3.23.0
pycups==2.0.4
Pygments==2.19.2
PyPDF2==3.0.1
diff --git a/pyproject.toml b/pyproject.toml
index a4f4c8a5c8..8a940cef87 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,7 +19,6 @@ dependencies = [
"psycopg2==2.9.10", # http://initd.org/psycopg/articles/tag/release/
"sqlalchemy>=1.3,<1.4", # http://docs.sqlalchemy.org/en/latest/changelog/index.html
"netifaces>=0.10,<0.12", # https://bitbucket.org/al45tair/netifaces/src/
- "pycryptodomex==3.23.0", # https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
"psutil>=5.5,<7.1", # https://github.com/giampaolo/psutil/blob/master/HISTORY.rst
"requests==2.32.3", # https://pypi.python.org/pypi/requests
"gevent==25.8.1", # http://www.gevent.org/changelog.html