Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1890: Add checks for validity of stored bcrypt hash

Browse Source 
When checking for a match, the BCryptPasswordEncoder validates
the stored hash against a pattern to check that it actually is
a bcrypt value.
This commit is contained in:
Luke Taylor
2012-02-22 14:36:13 +00:00
parent 5d71d2a4fa
commit 3760d792ea
2 changed files with 51 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java
View File

@@ -20,6 +20,8 @@ import static org.junit.Assert.assertTrue;
import org.junit.Test;
import java.security.SecureRandom;
/**
* @author Dave Syer
@@ -43,13 +45,6 @@ public class BCryptPasswordEncoderTests {
assertTrue(encoder.matches("passw\u9292rd", result));
}
@Test
public void matchesLengthChecked() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
String result = encoder.encode("password");
assertFalse(encoder.matches("password", result.substring(0,result.length()-2)));
}
@Test
public void notMatches() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
@@ -57,4 +52,43 @@ public class BCryptPasswordEncoderTests {
assertFalse(encoder.matches("bogus", result));
}
@Test
public void customStrength() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(8);
String result = encoder.encode("password");
assertTrue(encoder.matches("password", result));
}
@Test
public void customRandom() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(8, new SecureRandom());
String result = encoder.encode("password");
assertTrue(encoder.matches("password", result));
}
@Test(expected = IllegalArgumentException.class)
public void barfsOnNullEncodedValue() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
assertFalse(encoder.matches("password", null));
}
@Test(expected = IllegalArgumentException.class)
public void barfsOnEmptyEncodedValue() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
assertFalse(encoder.matches("password", ""));
}
@Test(expected = IllegalArgumentException.class)
public void barfsOnShortEncodedValue() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
String result = encoder.encode("password");
assertFalse(encoder.matches("password", result.substring(0, 4)));
}
@Test(expected = IllegalArgumentException.class)
public void barfsOnBogusEncodedValue() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
assertFalse(encoder.matches("password", "012345678901234567890123456789"));
}
}