Skip to content

Commit 2506b2a

Browse files
fabpotfabpot
committed
Merge branch '2.3'
* 2.3: bumped Symfony version to 2.3.7 updated VERSION for 2.3.6 updated CHANGELOG for 2.3.6 bumped Symfony version to 2.2.10 updated VERSION for 2.2.9 update CONTRIBUTORS for 2.2.9 updated CHANGELOG for 2.2.9 [Security] limited the password length passed to encoders [HttpKernel] Fixed a test (compiler pass class name has been changed). assets:install command should mirror .dotfiles (.htaccess) PoFileDumper - PO headers removed whitespaces Conflicts: src/Symfony/Component/HttpKernel/Kernel.php src/Symfony/Component/Security/Core/Encoder/BCryptPasswordEncoder.php src/Symfony/Component/Security/Core/Encoder/BasePasswordEncoder.php src/Symfony/Component/Security/Core/Encoder/MessageDigestPasswordEncoder.php src/Symfony/Component/Security/Core/Encoder/Pbkdf2PasswordEncoder.php src/Symfony/Component/Security/Core/Encoder/PlaintextPasswordEncoder.php src/Symfony/Component/Security/Core/Tests/Encoder/MessageDigestPasswordEncoderTest.php src/Symfony/Component/Security/Core/Tests/Encoder/Pbkdf2PasswordEncoderTest.php src/Symfony/Component/Security/Core/Tests/Encoder/PlaintextPasswordEncoderTest.php
2 parents 3241b28 + 804c738 commit 2506b2a

10 files changed

+63
-45
lines changed

‎Encoder/BCryptPasswordEncoder.php

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\Security\Core\Encoder;
1313

1414
use Symfony\Component\Security\Core\Encoder\BasePasswordEncoder;
15+
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
1516

1617
/**
1718
* @author Elnur Abdurrakhimov <[email protected]>
@@ -64,7 +65,9 @@ public function __construct($cost)
6465
*/
6566
public function encodePassword($raw, $salt)
6667
{
67-
$this->checkPasswordLength($raw);
68+
if ($this->isPasswordTooLong($raw)) {
69+
throw new BadCredentialsException('Invalid password.');
70+
}
6871

6972
$options = array('cost' => $this->cost);
7073

@@ -80,8 +83,6 @@ public function encodePassword($raw, $salt)
8083
*/
8184
public function isPasswordValid($encoded, $raw, $salt)
8285
{
83-
$this->checkPasswordLength($raw);
84-
85-
return password_verify($raw, $encoded);
86+
return !$this->isPasswordTooLong($raw) && password_verify($raw, $encoded);
8687
}
8788
}

‎Encoder/BasePasswordEncoder.php

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,10 +87,13 @@ protected function comparePasswords($password1, $password2)
8787
return StringUtils::equals($password1, $password2);
8888
}
8989

90-
protected function checkPasswordLength($password)
90+
/**
91+
* Checks if the password is too long.
92+
*
93+
* @return Boolean true if the password is too long, false otherwise
94+
*/
95+
protected function isPasswordTooLong($password)
9196
{
92-
if (strlen($password) > self::MAX_PASSWORD_LENGTH) {
93-
throw new BadCredentialsException('Invalid password.');
94-
}
97+
return strlen($password) > self::MAX_PASSWORD_LENGTH;
9598
}
9699
}

‎Encoder/MessageDigestPasswordEncoder.php

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111

1212
namespace Symfony\Component\Security\Core\Encoder;
1313

14+
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
15+
1416
/**
1517
* MessageDigestPasswordEncoder uses a message digest algorithm.
1618
*
@@ -41,7 +43,9 @@ public function __construct($algorithm = 'sha512', $encodeHashAsBase64 = true, $
4143
*/
4244
public function encodePassword($raw, $salt)
4345
{
44-
$this->checkPasswordLength($raw);
46+
if ($this->isPasswordTooLong($raw)) {
47+
throw new BadCredentialsException('Invalid password.');
48+
}
4549

4650
if (!in_array($this->algorithm, hash_algos(), true)) {
4751
throw new \LogicException(sprintf('The algorithm "%s" is not supported.', $this->algorithm));
@@ -63,8 +67,6 @@ public function encodePassword($raw, $salt)
6367
*/
6468
public function isPasswordValid($encoded, $raw, $salt)
6569
{
66-
$this->checkPasswordLength($raw);
67-
68-
return $this->comparePasswords($encoded, $this->encodePassword($raw, $salt));
70+
return !$this->isPasswordTooLong($raw) && $this->comparePasswords($encoded, $this->encodePassword($raw, $salt));
6971
}
7072
}

‎Encoder/Pbkdf2PasswordEncoder.php

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111

1212
namespace Symfony\Component\Security\Core\Encoder;
1313

14+
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
15+
1416
/**
1517
* Pbkdf2PasswordEncoder uses the PBKDF2 (Password-Based Key Derivation Function 2).
1618
*
@@ -54,7 +56,9 @@ public function __construct($algorithm = 'sha512', $encodeHashAsBase64 = true, $
5456
*/
5557
public function encodePassword($raw, $salt)
5658
{
57-
$this->checkPasswordLength($raw);
59+
if ($this->isPasswordTooLong($raw)) {
60+
throw new BadCredentialsException('Invalid password.');
61+
}
5862

5963
if (!in_array($this->algorithm, hash_algos(), true)) {
6064
throw new \LogicException(sprintf('The algorithm "%s" is not supported.', $this->algorithm));
@@ -74,9 +78,7 @@ public function encodePassword($raw, $salt)
7478
*/
7579
public function isPasswordValid($encoded, $raw, $salt)
7680
{
77-
$this->checkPasswordLength($raw);
78-
79-
return $this->comparePasswords($encoded, $this->encodePassword($raw, $salt));
81+
return !$this->isPasswordTooLong($raw) && $this->comparePasswords($encoded, $this->encodePassword($raw, $salt));
8082
}
8183

8284
private function hashPbkdf2($algorithm, $password, $salt, $iterations, $length = 0)

‎Encoder/PlaintextPasswordEncoder.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111

1212
namespace Symfony\Component\Security\Core\Encoder;
1313

14+
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
15+
1416
/**
1517
* PlaintextPasswordEncoder does not do any encoding.
1618
*
@@ -35,7 +37,9 @@ public function __construct($ignorePasswordCase = false)
3537
*/
3638
public function encodePassword($raw, $salt)
3739
{
38-
$this->checkPasswordLength($raw);
40+
if ($this->isPasswordTooLong($raw)) {
41+
throw new BadCredentialsException('Invalid password.');
42+
}
3943

4044
return $this->mergePasswordAndSalt($raw, $salt);
4145
}
@@ -45,7 +49,9 @@ public function encodePassword($raw, $salt)
4549
*/
4650
public function isPasswordValid($encoded, $raw, $salt)
4751
{
48-
$this->checkPasswordLength($raw);
52+
if ($this->isPasswordTooLong($raw)) {
53+
return false;
54+
}
4955

5056
$pass2 = $this->mergePasswordAndSalt($raw, $salt);
5157

‎Tests/Encoder/BCryptPasswordEncoderTest.php

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -64,30 +64,27 @@ public function testValidation()
6464
$this->assertFalse($encoder->isPasswordValid($result, 'anotherPassword', null));
6565
}
6666

67+
private function skipIfPhpVersionIsNotSupported()
68+
{
69+
if (version_compare(phpversion(), '5.3.7', '<')) {
70+
$this->markTestSkipped('Requires PHP >= 5.3.7');
71+
}
72+
}
73+
6774
/**
6875
* @expectedException \Symfony\Component\Security\Core\Exception\BadCredentialsException
6976
*/
7077
public function testEncodePasswordLength()
7178
{
72-
$encoder = new BCryptPasswordEncoder(4);
79+
$encoder = new BCryptPasswordEncoder(self::VALID_COST);
7380

7481
$encoder->encodePassword(str_repeat('a', 5000), 'salt');
7582
}
7683

77-
/**
78-
* @expectedException \Symfony\Component\Security\Core\Exception\BadCredentialsException
79-
*/
8084
public function testCheckPasswordLength()
8185
{
82-
$encoder = new BCryptPasswordEncoder(4);
83-
84-
$encoder->isPasswordValid('encoded', str_repeat('a', 5000), 'salt');
85-
}
86+
$encoder = new BCryptPasswordEncoder(self::VALID_COST);
8687

87-
private function skipIfPhpVersionIsNotSupported()
88-
{
89-
if (version_compare(phpversion(), '5.3.7', '<')) {
90-
$this->markTestSkipped('Requires PHP >= 5.3.7');
91-
}
88+
$this->assertFalse($encoder->isPasswordValid('encoded', str_repeat('a', 5000), 'salt'));
9289
}
9390
}

‎Tests/Encoder/BasePasswordEncoderTest.php

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ public function testMergePasswordAndSaltWithException()
5353
$this->invokeMergePasswordAndSalt('password', '{foo}');
5454
}
5555

56+
public function testIsPasswordTooLong()
57+
{
58+
$this->assertTrue($this->invokeIsPasswordTooLong(str_repeat('a', 10000)));
59+
$this->assertFalse($this->invokeIsPasswordTooLong(str_repeat('a', 10)));
60+
}
61+
5662
protected function invokeDemergePasswordAndSalt($password)
5763
{
5864
$encoder = new PasswordEncoder();
@@ -82,4 +88,14 @@ protected function invokeComparePasswords($p1, $p2)
8288

8389
return $m->invoke($encoder, $p1, $p2);
8490
}
91+
92+
protected function invokeIsPasswordTooLong($p)
93+
{
94+
$encoder = new PasswordEncoder();
95+
$r = new \ReflectionObject($encoder);
96+
$m = $r->getMethod('isPasswordTooLong');
97+
$m->setAccessible(true);
98+
99+
return $m->invoke($encoder, $p);
100+
}
85101
}

‎Tests/Encoder/MessageDigestPasswordEncoderTest.php

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -53,13 +53,10 @@ public function testEncodePasswordLength()
5353
$encoder->encodePassword(str_repeat('a', 5000), 'salt');
5454
}
5555

56-
/**
57-
* @expectedException \Symfony\Component\Security\Core\Exception\BadCredentialsException
58-
*/
5956
public function testCheckPasswordLength()
6057
{
6158
$encoder = new MessageDigestPasswordEncoder();
6259

63-
$encoder->isPasswordValid('encoded', str_repeat('a', 5000), 'salt');
60+
$this->assertFalse($encoder->isPasswordValid('encoded', str_repeat('a', 5000), 'salt'));
6461
}
6562
}

‎Tests/Encoder/Pbkdf2PasswordEncoderTest.php

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,18 +48,15 @@ public function testEncodePasswordAlgorithmDoesNotExist()
4848
*/
4949
public function testEncodePasswordLength()
5050
{
51-
$encoder = new Pbkdf2PasswordEncoder();
51+
$encoder = new Pbkdf2PasswordEncoder('foobar');
5252

5353
$encoder->encodePassword(str_repeat('a', 5000), 'salt');
5454
}
5555

56-
/**
57-
* @expectedException \Symfony\Component\Security\Core\Exception\BadCredentialsException
58-
*/
5956
public function testCheckPasswordLength()
6057
{
61-
$encoder = new Pbkdf2PasswordEncoder();
58+
$encoder = new Pbkdf2PasswordEncoder('foobar');
6259

63-
$encoder->isPasswordValid('encoded', str_repeat('a', 5000), 'salt');
60+
$this->assertFalse($encoder->isPasswordValid('encoded', str_repeat('a', 5000), 'salt'));
6461
}
6562
}

‎Tests/Encoder/PlaintextPasswordEncoderTest.php

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,10 @@ public function testEncodePasswordLength()
4747
$encoder->encodePassword(str_repeat('a', 5000), 'salt');
4848
}
4949

50-
/**
51-
* @expectedException \Symfony\Component\Security\Core\Exception\BadCredentialsException
52-
*/
5350
public function testCheckPasswordLength()
5451
{
5552
$encoder = new PlaintextPasswordEncoder();
5653

57-
$encoder->isPasswordValid('encoded', str_repeat('a', 5000), 'salt');
54+
$this->assertFalse($encoder->isPasswordValid('encoded', str_repeat('a', 5000), 'salt'));
5855
}
5956
}

0 commit comments

Comments
 (0)