TheCloud/v
1
0
Fork 0
mirror of https://github.com/vlang/v.git synced 2025-09-10 07:47:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

crypt.bcrypt: limit max password length to 72 bytes (#23229)

Browse Source
This commit is contained in:
kbkpbot 2024-12-21 19:11:06 +08:00 committed by GitHub
parent 40bb8b1d17
commit c968c9ec60
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
vlib/crypto/bcrypt/bcrypt.v
View File

@ -15,6 +15,8 @@ pub const min_hash_size = 59
pub const major_version = '2' pub const major_version = '2'
pub const minor_version = 'a' pub const minor_version = 'a'
const error_msg_max_length_exceed_72 = 'Maximum password length is 72 bytes'
pub struct Hashed { pub struct Hashed {
mut: mut:
hash []u8 hash []u8
@ -41,6 +43,9 @@ const magic_cipher_data = [u8(0x4f), 0x72, 0x70, 0x68, 0x65, 0x61, 0x6e, 0x42, 0
// generate_from_password return a bcrypt string from Hashed struct. // generate_from_password return a bcrypt string from Hashed struct.
pub fn generate_from_password(password []u8, cost int) !string { pub fn generate_from_password(password []u8, cost int) !string {
if password.len > 72 {
return error(error_msg_max_length_exceed_72)
}
mut p := new_from_password(password, cost) or { return error('Error: ${err}') } mut p := new_from_password(password, cost) or { return error('Error: ${err}') }
x := p.hash_u8() x := p.hash_u8()
return x.bytestr() return x.bytestr()
@ -48,6 +53,9 @@ pub fn generate_from_password(password []u8, cost int) !string {
// compare_hash_and_password compares a bcrypt hashed password with its possible hashed version. // compare_hash_and_password compares a bcrypt hashed password with its possible hashed version.
pub fn compare_hash_and_password(password []u8, hashed_password []u8) ! { pub fn compare_hash_and_password(password []u8, hashed_password []u8) ! {
if password.len > 72 {
return error(error_msg_max_length_exceed_72)
}
mut p := new_from_hash(hashed_password) or { return error('Error: ${err}') } mut p := new_from_hash(hashed_password) or { return error('Error: ${err}') }
p.salt << `=` p.salt << `=`
p.salt << `=` p.salt << `=`

9
vlib/crypto/bcrypt/bcrypt_test.v
View File

@ -18,4 +18,13 @@ fn test_crypto_bcrypt() {
} }
assert hash2_must_mismatch assert hash2_must_mismatch
long_password := 'jvaqhblwxtoytiaglflbisdeyoieianidksglxyitwopxgrjurhjvrsuydlcguaiueliuoikabibownvfcrcaogheq'
assert long_password.len > 72
bcrypt.generate_from_password(long_password.bytes(), 5) or {
assert err.msg() == 'Maximum password length is 72 bytes'
}
bcrypt.compare_hash_and_password(long_password.bytes(), hash2.bytes()) or {
assert err.msg() == 'Maximum password length is 72 bytes'
}
} }