[ruby-core:68577] [Ruby trunk - Bug #10988] [Open] [PATCH] Raise ArgumentError when string passed to String#crypt contains null

[ruby-core:68577] [Ruby trunk - Bug #10988] [Open] [PATCH] Raise ArgumentError when string passed to String#crypt contains null

[jrusnack]

Issue #10988 has been reported by Jan Rusnacko.

----------------------------------------
Bug #10988: [PATCH] Raise ArgumentError when string passed to String#crypt contains null
https://bugs.ruby-lang.org/issues/10988

* Author: Jan Rusnacko
* Status: Open
* Priority: Normal
* Assignee: 
* ruby -v: 2.3.0dev
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN
----------------------------------------
Currently String#crypt assumes that it is called on a password typed
by the user, specifically, that it does not contain null character.
When it does:

    "abc\0def".crypt("pass") == "abc".crypt("pass")
    => true

This may not be desirable, and developers invoking crypt on strings
that potentially include null may expect different results. To
prevent security failures, this patch changes String#crypt to throw
ArgumentError when invoked on String that includes null character.

https://www.reddit.com/r/netsec/comments/2yugos/null_bytes_bcrypt_problem/

Also PR: https://github.com/ruby/ruby/pull/853

---Files--------------------------------
0001-Raise-ArgumentError-when-string-passed-to-String-cry.patch (1.87 KB)


-- 
https://bugs.ruby-lang.org/

[ruby-core:68586] [Ruby trunk - Bug #10988] [PATCH] Raise ArgumentError when string passed to String#crypt contains null

[nobu]

Issue #10988 has been updated by Nobuyoshi Nakada.


I agree this behavior would be better, but maybe a feature request?

----------------------------------------
Bug #10988: [PATCH] Raise ArgumentError when string passed to String#crypt contains null
https://bugs.ruby-lang.org/issues/10988#change-51897

* Author: Jan Rusnacko
* Status: Open
* Priority: Normal
* Assignee: 
* ruby -v: 2.3.0dev
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN
----------------------------------------
Currently String#crypt assumes that it is called on a password typed
by the user, specifically, that it does not contain null character.
When it does:

    "abc\0def".crypt("pass") == "abc".crypt("pass")
    => true

This may not be desirable, and developers invoking crypt on strings
that potentially include null may expect different results. To
prevent security failures, this patch changes String#crypt to throw
ArgumentError when invoked on String that includes null character.

https://www.reddit.com/r/netsec/comments/2yugos/null_bytes_bcrypt_problem/

Also PR: https://github.com/ruby/ruby/pull/853

---Files--------------------------------
0001-Raise-ArgumentError-when-string-passed-to-String-cry.patch (1.87 KB)


-- 
https://bugs.ruby-lang.org/

[ruby-core:69805] [Ruby trunk - Bug #10988] [PATCH] Raise ArgumentError when string passed to String#crypt contains null

[usa]

Issue #10988 has been updated by Usaku NAKAMURA.

Backport changed from 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN to 2.0.0: WONTFIX, 2.1: WONTFIX, 2.2: UNKNOWN

----------------------------------------
Bug #10988: [PATCH] Raise ArgumentError when string passed to String#crypt contains null
https://bugs.ruby-lang.org/issues/10988#change-53201

* Author: Jan Rusnacko
* Status: Closed
* Priority: Normal
* Assignee: 
* ruby -v: 2.3.0dev
* Backport: 2.0.0: WONTFIX, 2.1: WONTFIX, 2.2: UNKNOWN
----------------------------------------
Currently String#crypt assumes that it is called on a password typed
by the user, specifically, that it does not contain null character.
When it does:

    "abc\0def".crypt("pass") == "abc".crypt("pass")
    => true

This may not be desirable, and developers invoking crypt on strings
that potentially include null may expect different results. To
prevent security failures, this patch changes String#crypt to throw
ArgumentError when invoked on String that includes null character.

https://www.reddit.com/r/netsec/comments/2yugos/null_bytes_bcrypt_problem/

Also PR: https://github.com/ruby/ruby/pull/853

---Files--------------------------------
0001-Raise-ArgumentError-when-string-passed-to-String-cry.patch (1.87 KB)


-- 
https://bugs.ruby-lang.org/

[ruby-core:69838] [Ruby trunk - Bug #10988] [PATCH] Raise ArgumentError when string passed to String#crypt contains null

[nagachika00]

Issue #10988 has been updated by Tomoyuki Chikanaga.

Backport changed from 2.0.0: WONTFIX, 2.1: WONTFIX, 2.2: UNKNOWN to 2.0.0: WONTFIX, 2.1: WONTFIX, 2.2: WONTFIX

----------------------------------------
Bug #10988: [PATCH] Raise ArgumentError when string passed to String#crypt contains null
https://bugs.ruby-lang.org/issues/10988#change-53236

* Author: Jan Rusnacko
* Status: Closed
* Priority: Normal
* Assignee: 
* ruby -v: 2.3.0dev
* Backport: 2.0.0: WONTFIX, 2.1: WONTFIX, 2.2: WONTFIX
----------------------------------------
Currently String#crypt assumes that it is called on a password typed
by the user, specifically, that it does not contain null character.
When it does:

    "abc\0def".crypt("pass") == "abc".crypt("pass")
    => true

This may not be desirable, and developers invoking crypt on strings
that potentially include null may expect different results. To
prevent security failures, this patch changes String#crypt to throw
ArgumentError when invoked on String that includes null character.

https://www.reddit.com/r/netsec/comments/2yugos/null_bytes_bcrypt_problem/

Also PR: https://github.com/ruby/ruby/pull/853

---Files--------------------------------
0001-Raise-ArgumentError-when-string-passed-to-String-cry.patch (1.87 KB)


-- 
https://bugs.ruby-lang.org/