From e129934aac42835c3aabf77e1e4de389c06643f9 Mon Sep 17 00:00:00 2001
From: StNicolay <stnicolay2007@mail.ru>
Date: Thu, 4 May 2023 19:39:36 +0300
Subject: [PATCH] Made verify_master_pass compute the hash in a blocking thread

---
 src/entity/master_pass.rs             | 9 ++++++---
 src/handlers/state/get_master_pass.rs | 3 ++-
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/entity/master_pass.rs b/src/entity/master_pass.rs
index df86a43..2b0c166 100644
--- a/src/entity/master_pass.rs
+++ b/src/entity/master_pass.rs
@@ -3,6 +3,7 @@
 use rand::{rngs::OsRng, RngCore};
 use scrypt::{scrypt, Params};
 use sea_orm::{entity::prelude::*, ActiveValue::Set, QuerySelect};
+use tokio::task::spawn_blocking;
 
 #[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
 #[sea_orm(table_name = "master_pass")]
@@ -43,7 +44,7 @@ impl ActiveModel {
 impl Entity {
     pub async fn verify_master_pass(
         user_id: u64,
-        master_pass: &str,
+        master_pass: String,
         db: &DatabaseConnection,
     ) -> crate::Result<Option<bool>> {
         let model = match Self::find_by_id(user_id).one(db).await {
@@ -51,8 +52,10 @@ impl Entity {
             Ok(None) => return Ok(None),
             Err(err) => return Err(err.into()),
         };
-        let password_hash = hash_password(master_pass.as_ref(), &model.salt)?;
-        Ok(Some(password_hash == model.password_hash))
+        let (hash, salt) = (model.password_hash, model.salt);
+        let password_hash =
+            spawn_blocking(move || hash_password(master_pass.as_bytes(), &salt)).await??;
+        Ok(Some(password_hash == hash))
     }
 
     /// Checks if the master password for the user exists
diff --git a/src/handlers/state/get_master_pass.rs b/src/handlers/state/get_master_pass.rs
index a36672f..02362c3 100644
--- a/src/handlers/state/get_master_pass.rs
+++ b/src/handlers/state/get_master_pass.rs
@@ -12,7 +12,8 @@ pub async fn check_master_pass<'a>(
     db: &'a DatabaseConnection,
     master_pass: &'a str,
 ) -> crate::Result<bool> {
-    let result = MasterPass::verify_master_pass(msg.from().unwrap().id.0, master_pass, db).await;
+    let result =
+        MasterPass::verify_master_pass(msg.from().unwrap().id.0, master_pass.to_owned(), db).await;
     match result {
         Ok(Some(true)) => Ok(true),
         Ok(Some(false)) => {