Running python with optimizations makes UsernamePasswordMako accept any password for any user

On the current master branch, the UsernamePasswordMako class relies on an assert statement to check the user’s password: https://github.com/rohe/pysaml2/blob/9cbbd9bd9f6bfa5e9ceace064dd1af4e2ff2f68c/src/saml2/authn.py#L149

The assert is supposed to raise an exception if the password doesn’t match. This is insecure: running python with optimizations enabled (either via the -O or -OO flags, or with the PYTHONOPTIMIZE environment variable) will remove all such assertions. This means that no exception will be raised on an incorrect password, and the UsernamePasswordMako will accept any password for any user.

It would be better to have an explicit check that raises an exception to avoid this problem.

[rohe]

I’ll go through the code and replace all assert statements with if statements.

[obi1kenobi]

In my opinion, it would be better to leave this as a breaking change and signal that through semver. Raising AssertionError to indicate authentication failure seems unintuitive at best, and we’re better off without it IMHO.