Skip to content

Commit 0dc1831

Browse files
xabbuhxabbuh
committed
Merge branch '7.0' into 7.1
* 7.0: replace wurstmeister Docker images for Kafka and Zookeeper [PasswordHasher] Make bcrypt nul byte hash test tolerant to PHP related failures [HttpClient] Revert fixing curl default options [VarExporter] fix proxy helper when a method returns null [Validator] Update Dutch (nl) translation Fix exception thrown during `LDAP_MODIFY_BATCH_REMOVE_ALL` batch operations Fix various warnings across components test suite
2 parents de25c38 + c6585f5 commit 0dc1831

File tree

2 files changed

+65
-9
lines changed

2 files changed

+65
-9
lines changed

‎Tests/Hasher/NativePasswordHasherTest.php‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,16 +99,44 @@ public function testBcryptWithLongPassword()
9999
$this->assertTrue($hasher->verify($hasher->hash($plainPassword), $plainPassword));
100100
}
101101

102-
public function testBcryptWithNulByte()
102+
/**
103+
* @requires PHP < 8.4
104+
*/
105+
public function testBcryptWithNulByteWithNativePasswordHash()
103106
{
104107
$hasher = new NativePasswordHasher(null, null, 4, \PASSWORD_BCRYPT);
105108
$plainPassword = "a\0b";
106109

107-
if (\PHP_VERSION_ID < 80218 || \PHP_VERSION_ID >= 80300 && \PHP_VERSION_ID < 80305) {
108-
// password_hash() does not accept passwords containing NUL bytes since PHP 8.2.18 and 8.3.5
109-
$this->assertFalse($hasher->verify(password_hash($plainPassword, \PASSWORD_BCRYPT, ['cost' => 4]), $plainPassword));
110+
try {
111+
$hash = password_hash($plainPassword, \PASSWORD_BCRYPT, ['cost' => 4]);
112+
} catch (\Throwable $throwable) {
113+
// we skip the test in case the current PHP version does not support NUL bytes in passwords
114+
// with bcrypt
115+
//
116+
// @see https://github.com/php/php-src/commit/11f2568767660ffe92fbc6799800e01203aad73a
117+
if (str_contains($throwable->getMessage(), 'Bcrypt password must not contain null character')) {
118+
$this->markTestSkipped('password_hash() does not accept passwords containing NUL bytes.');
119+
}
120+
121+
throw $throwable;
110122
}
111123

124+
if (null === $hash) {
125+
// we also skip the test in case password_hash() returns null as
126+
// implemented in security patches backports
127+
//
128+
// @see https://github.com/shivammathur/php-src-backports/commit/d22d9ebb29dce86edd622205dd1196a2796c08c7
129+
$this->markTestSkipped('password_hash() does not accept passwords containing NUL bytes.');
130+
}
131+
132+
$this->assertTrue($hasher->verify($hash, $plainPassword));
133+
}
134+
135+
public function testPasswordNulByteGracefullyHandled()
136+
{
137+
$hasher = new NativePasswordHasher(null, null, 4, \PASSWORD_BCRYPT);
138+
$plainPassword = "a\0b";
139+
112140
$this->assertTrue($hasher->verify($hasher->hash($plainPassword), $plainPassword));
113141
}
114142

‎Tests/Hasher/SodiumPasswordHasherTest.php‎

Lines changed: 33 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -73,17 +73,45 @@ public function testBcryptWithLongPassword()
7373
$this->assertTrue($hasher->verify((new NativePasswordHasher(null, null, 4, \PASSWORD_BCRYPT))->hash($plainPassword), $plainPassword));
7474
}
7575

76-
public function testBcryptWithNulByte()
76+
/**
77+
* @requires PHP < 8.4
78+
*/
79+
public function testBcryptWithNulByteWithNativePasswordHash()
7780
{
7881
$hasher = new SodiumPasswordHasher(null, null);
7982
$plainPassword = "a\0b";
8083

81-
if (\PHP_VERSION_ID < 80218 || \PHP_VERSION_ID >= 80300 && \PHP_VERSION_ID < 80305) {
82-
// password_hash() does not accept passwords containing NUL bytes since PHP 8.2.18 and 8.3.5
83-
$this->assertFalse($hasher->verify(password_hash($plainPassword, \PASSWORD_BCRYPT, ['cost' => 4]), $plainPassword));
84+
try {
85+
$hash = password_hash($plainPassword, \PASSWORD_BCRYPT, ['cost' => 4]);
86+
} catch (\Throwable $throwable) {
87+
// we skip the test in case the current PHP version does not support NUL bytes in passwords
88+
// with bcrypt
89+
//
90+
// @see https://github.com/php/php-src/commit/11f2568767660ffe92fbc6799800e01203aad73a
91+
if (str_contains($throwable->getMessage(), 'Bcrypt password must not contain null character')) {
92+
$this->markTestSkipped('password_hash() does not accept passwords containing NUL bytes.');
93+
}
94+
95+
throw $throwable;
8496
}
8597

86-
$this->assertTrue($hasher->verify((new NativePasswordHasher(null, null, 4, \PASSWORD_BCRYPT))->hash($plainPassword), $plainPassword));
98+
if (null === $hash) {
99+
// we also skip the test in case password_hash() returns null as
100+
// implemented in security patches backports
101+
//
102+
// @see https://github.com/shivammathur/php-src-backports/commit/d22d9ebb29dce86edd622205dd1196a2796c08c7
103+
$this->markTestSkipped('password_hash() does not accept passwords containing NUL bytes.');
104+
}
105+
106+
$this->assertTrue($hasher->verify($hash, $plainPassword));
107+
}
108+
109+
public function testPasswordNulByteGracefullyHandled()
110+
{
111+
$hasher = new SodiumPasswordHasher(null, null);
112+
$plainPassword = "a\0b";
113+
114+
$this->assertTrue($hasher->verify($hasher->hash($plainPassword), $plainPassword));
87115
}
88116

89117
public function testUserProvidedSaltIsNotUsed()

0 commit comments

Comments
 (0)