Correct bcrypt salt regex #1279
Conversation
|
|
pw_hash is a functionBreaking changes to this file MAY impact these 11 modules (near match):This module is declared in 318 of 579 indexed public
|
|
Hi @sabo - thanks for submitting this PR. Whilst the changes look good, could I ask that you look to resolve the present test failures and sign our CLA so we can proceed with this. :-) |
|
@sabo - please disregard my previous comment regarding the test failures, the failures present at first appeared to be transient. (With exception of Windows 2012 R2, these tests are regularly failing in our nightlies and not thought to be due to your PR) Could you please rebase with the current main branch, and sign our CLA, so that we can proceed with this. |
|
Hi @jordanbreen28, working on getting approval for that CLA. |
|
Great @sabo - in the meantime could you rebase this PR with the current main :-) |
The two-digit header of a bcrypt salt is a strength parameter. Valid values for the strength parameter range from 4 to 31 inclusive. Update the regex used to check the salt to only match against values from 04 to 31.
mention the meaning of the first two characters as a strength parameter
sabo
force-pushed
the
fix_bcrypt_salt_regex
branch
from
4ffce2d to
90a8760
Compare
|
@jordanbreen28, branch rebased and CLA signed, should be good to go |
|
@sabo Great work :-) Just one more small thing before merging, could you please squash your commits into a single commit for this PR. |
|
You can squash on merge using GitHub's web interface. |
This corrects the regex used by the pw_hash function for bcrypt-type hashes. The first two characters are interpreted as a strength parameter by bcrypt, and must take a value between 4 and 31 inclusive.