In some cases, the response body pulled from the HaveIBeenPwned API can end with a blank space after the final new line characters. When pulled into the $lines array, this creates an index that consists of just a blank string.
When attempting to call list() on the result of calling explode(':', $line), an Exception is thrown.
This Exception is not caught in this package, or within Laravel NIST which uses it. The stack trace of this Exception exposes the User's password to any logs that record it.
Passing the $lines array through an array_filter() removes any blank indexes and prevents this error.
In some cases, the response body pulled from the HaveIBeenPwned API can end with a blank space after the final new line characters. When pulled into the
$lines
array, this creates an index that consists of just a blank string.When attempting to call
list()
on the result of callingexplode(':', $line)
, an Exception is thrown.This Exception is not caught in this package, or within Laravel NIST which uses it. The stack trace of this Exception exposes the User's password to any logs that record it.
Passing the
$lines
array through anarray_filter()
removes any blank indexes and prevents this error.