search

DivineOmega / password_exposed

🔒 Password Exposed Helper Function - Check if a password has been exposed in a data breach.
GNU Lesser General Public License v3.0
213 stars 34 forks source link

Empty string in $line causes an Exception that can expose a User's password #35

Open jamieb-tillo opened 2 years ago

jamieb-tillo commented 2 years ago

In this method, if the $line variable does not contain a colon (e.g., is an empty string), then the call to list() will throw an Exception.

https://github.com/DivineOmega/password_exposed/blob/327f93ee5cab54622077bcae721412b55be16720/src/AbstractPasswordExposedChecker.php#L147

This exception is not caught by the handling in NIST or the DivineOmega packages. The stack trace of this exception will contain the submitted password in plain text.

Neven21 commented 2 years ago

Same problem. Thanks for the fix.