pyca / bcrypt

Modern(-ish) password hashing for your software and your servers
Apache License 2.0
1.26k stars 168 forks source link

Raised pyo3_runtime.PanicException instead ValueError with invalid salt using #917

Closed gelezo43 closed 16 hours ago

gelezo43 commented 22 hours ago

bcrypt 4.2.0 does not handle invalid values ​​properly.

bcrypt.checkpw(b"password", b"$2b$12$incorrect")
thread '<unnamed>' panicked at src\lib.rs:109:30:
range end index 22 out of range for slice of length 9
Traceback (most recent call last):
  File "C:\Program Files\JetBrains\PyCharm Community Edition 2024.1.3\plugins\python-ce\helpers\pydev\pydevconsole.py", line 364, in runcode
    coro = func()
           ^^^^^^
  File "<input>", line 1, in <module>
pyo3_runtime.PanicException: range end index 22 out of range for slice of length 9

It is expected that if the value is invalid, a ValueError exception should be raised