Merge branch 'main' into sast

Makefile

@@ -5,16 +5,14 @@ build:
 
 .PHONY: test
 test:
-	stdout=$$(gofmt -l . 2>&1); \
+	stdout=$$(gofmt -l . 2>&1); if [ "$$stdout" ]; then exit 1; fi
-	if [ "$$stdout" ]; then \
-		exit 1; \
-	fi
 	go vet ./...
 	gocyclo -over 10 $(shell find . -iname '*.go' -type f)
 	staticcheck ./...
 	go test -v -cover ./...
 	gosec -exclude-dir=tests ./...
 	semgrep --lang=go --config=tests/semgrep
+	@printf '\n%s\n' "> Test successful"
 
 .PHONY: setup
 setup:

internal/authentication/token.go

@@ -53,5 +53,7 @@ func GenerateApplicationToken(compat bool) string {
 		tokenLength = compatTokenLength
 	}
 
+	tokenLength -= len(applicationTokenPrefix)
+
 	return applicationTokenPrefix + generateRandomString(tokenLength)
 }

internal/authentication/token_test.go

@@ -1,28 +1,29 @@
 package authentication
 
 import (
-	"log"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func isGoodToken(assert *assert.Assertions, require *require.Assertions, token string, compat bool) {
+const (
-	prefix := token[0:len(applicationTokenPrefix)]
+	minRandomChars = 14
-	token = token[len(applicationTokenPrefix):]
+)
 
-	// Although constant at the time of writing, this check should prevent future changes from generating insecure tokens.
+func isGoodToken(assert *assert.Assertions, require *require.Assertions, token string, compat bool) {
-	if len(token) < 14 {
+	tokenLength := len(token)
-		log.Fatalf("Tokens should have more random characters")
-	}
 
 	if compat {
-		assert.Equal(len(token), compatTokenLength, "Unexpected compatibility token length")
+		assert.Equal(tokenLength, compatTokenLength, "Unexpected compatibility token length")
 	} else {
-		assert.Equal(len(token), regularTokenLength, "Unexpected regular token length")
+		assert.Equal(tokenLength, regularTokenLength, "Unexpected regular token length")
 	}
 
+	randomChars := tokenLength - len(applicationTokenPrefix)
+	assert.GreaterOrEqual(randomChars, minRandomChars, "Token is too short to give sufficient entropy")
+
+	prefix := token[0:len(applicationTokenPrefix)]
 	assert.Equal(prefix, applicationTokenPrefix, "Invalid token prefix")
 
 	for _, c := range []byte(token) {