improved security checks

kvmd/plugins/auth/htpasswd.py

@@ -43,5 +43,7 @@ class Plugin(BaseAuthService):
         }
 
     async def authorize(self, user: str, passwd: str) -> bool:
+        assert user == user.strip()
+        assert user
         htpasswd = passlib.apache.HtpasswdFile(self.__path)
         return htpasswd.check_password(user, passwd)

kvmd/plugins/auth/http.py

@@ -71,6 +71,8 @@ class Plugin(BaseAuthService):
         }
 
     async def authorize(self, user: str, passwd: str) -> bool:
+        assert user == user.strip()
+        assert user
         session = self.__ensure_session()
         try:
             async with session.request(

kvmd/plugins/auth/pam.py

@@ -67,6 +67,8 @@ class Plugin(BaseAuthService):
         }
 
     async def authorize(self, user: str, passwd: str) -> bool:
+        assert user == user.strip()
+        assert user
         async with self.__lock:
             return (await aiotools.run_async(self.__inner_authorize, user, passwd))