bcrypt 3.1.14-java → 3.1.17-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9581d38b9f8ace7c8c0ef1a7a9e4a73dd1c4326392de7147dfe2a51e42c5b9a0
-  data.tar.gz: 2aedddb181acd0cdf6d3506f78c20148057968e8c53d89a90778673aa825e271
+  metadata.gz: 982723920ec5f97cff8b34987babf6a5f1ee632e8f942e40cf28246940e067d6
+  data.tar.gz: ab2bb1ace746eb5efa5b2ce1d9b1bcc9fe5445899ae3c78510198a6df19152d0
 SHA512:
-  metadata.gz: 60a8e9c4381fc55f5323204391d0f2c5c17bb0e2b0660d43db58c124c1aaceb29cd03b3e565ad48796d71da94aa1d049ad5ab24eb61bbc30a429a22b74a94961
-  data.tar.gz: 7a8c99a0ac391f11cb55d7e8ce12125f6892aaea701c4c26ffbdc486a8cd87b3215e5f7a903ef063c36d4954fa262c13ab40f086b0f5a8d8f8d60f87b0daeb13
+  metadata.gz: 79951a4c7612737f25550f701d387d7c7325798eae87d898cccefd83762cf713d9817a19ca29d95b950ed85b32915efbdf7dd93e146a08230135309876a26a27
+  data.tar.gz: d3618098d76210298bb5e05b39f75469cc4f64dfea5e55cc5cebf0372eb8a529b076d771f184e311c564a6d08932b7160fb46355e09188592f7de1608dd65d83

data/.github/workflows/ruby.yml

@@ -0,0 +1,57 @@
+name: Test Suite
+
+# Run against all commits and pull requests.
+on: [ push, pull_request ]
+
+jobs:
+  test_matrix:
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu
+          - macos
+          - windows
+        ruby:
+          - 2.1
+          - 2.2
+          - 2.3
+          - 2.4
+          - 2.5
+          - 2.6
+          - 2.7
+          - '3.0'
+          - 3.1
+          - head
+          - jruby
+          - jruby-head
+          - truffleruby
+          - truffleruby-head
+          - mingw
+        exclude:
+          - { os: ubuntu,  ruby: jruby }
+          - { os: ubuntu,  ruby: jruby-head }
+          - { os: ubuntu,  ruby: mingw }
+          - { os: macos,   ruby: mingw }
+          - { os: windows, ruby: truffleruby }
+          - { os: windows, ruby: truffleruby-head }
+
+    runs-on: ${{ matrix.os }}-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Run tests
+        run: bundle exec rake default
+
+  finish:
+    runs-on: ubuntu-latest
+    needs: [ test_matrix ]
+    steps:
+      - name: Wait for status checks
+        run: echo "All Green!"

data/.gitignore

@@ -7,3 +7,4 @@ tmp
 *.jar
 .DS_Store
 .rbenv-gemsets
+Gemfile.lock

data/CHANGELOG

@@ -1,3 +1,14 @@
+3.1.17 Mar 14 2022
+- Fix regex in validators to use \A and \z instead of ^ and $ [GH #121]
+- Truncate secrets greater than 72 bytes in hash_secret [GH #255]
+- Assorted test and doc improvements
+
+3.1.16 Sep 3 2020
+  - Fix compilation on FreeBSD. [GH #234]
+
+3.1.15 July 21 2020
+  - Remove GVL optimization.  Apparently it breaks things [GH #230]
+
 3.1.14 July 21 2020
   - Start calibration from the minimum cost supported by the algorithm [GH #206 by @sergey-alekseev]
 
@@ -10,7 +21,7 @@
 
 3.1.12 May 16 2018
   - Add support for Ruby 2.3, 2.4, and 2.5 in compiled Windows binaries
-  - Fix compatibility with libxcrypt [GH #164 by @besser82]
+  - Fix compatibility with libxcrypt - Fixes hash errors in Fedora 28 and Ubuntu 20 [GH #164 by @besser82]
 
 3.1.11 Mar 06 2016
   - Add support for Ruby 2.2 in compiled Windows binaries

data/README.md

@@ -2,12 +2,11 @@
 
 An easy way to keep your users' passwords secure.
 
-* https://github.com/codahale/bcrypt-ruby/tree/master
+* https://github.com/bcrypt-ruby/bcrypt-ruby/tree/master
 
-[![Travis Build Status](https://travis-ci.org/codahale/bcrypt-ruby.svg?branch=master)](https://travis-ci.org/codahale/bcrypt-ruby)
+[![Github Actions Build Status](https://github.com/bcrypt-ruby/bcrypt-ruby/actions/workflows/ruby.yml/badge.svg?branch=master)](https://github.com/bcrypt-ruby/bcrypt-ruby/actions/workflows/ruby.yml)
 [![AppVeyor Build Status](https://ci.appveyor.com/api/projects/status/6fplerx9lnaf0hyo?svg=true)](https://ci.appveyor.com/project/TJSchuck35975/bcrypt-ruby)
 
-
 ## Why you should use `bcrypt()`
 
 If you store user passwords in the clear, then an attacker who steals a copy of your database has a giant list of emails
@@ -32,8 +31,8 @@ re-hash those passwords. This vulnerability only affected the JRuby gem.
 The bcrypt gem is available on the following Ruby platforms:
 
 * JRuby
-* RubyInstaller 2.0 – 2.5 builds on Windows with the DevKit
-* Any 2.0 – 2.5 Ruby on a BSD/OS X/Linux system with a compiler
+* RubyInstaller 2.0 – 3.0 builds on Windows with the DevKit
+* Any 2.0 – 3.0 Ruby on a BSD/OS X/Linux system with a compiler
 
 ## How to use `bcrypt()` in your Rails application
 

data/bcrypt.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = 'bcrypt'
-  s.version = '3.1.14'
+  s.version = '3.1.17'
 
   s.summary = "OpenBSD's bcrypt() password hashing algorithm."
   s.description = <<-EOF
@@ -22,6 +22,6 @@ Gem::Specification.new do |s|
 
   s.authors = ["Coda Hale"]
   s.email = "coda.hale@gmail.com"
-  s.homepage = "https://github.com/codahale/bcrypt-ruby"
+  s.homepage = "https://github.com/bcrypt-ruby/bcrypt-ruby"
   s.license = "MIT"
 end

data/ext/mri/bcrypt_ext.c

@@ -1,50 +1,20 @@
 #include <ruby.h>
 #include <ow-crypt.h>
 
-#ifdef HAVE_RUBY_THREAD_H
-#include <ruby/thread.h>
-#endif
-
 static VALUE mBCrypt;
 static VALUE cBCryptEngine;
 
-struct bc_salt_args {
-    const char * prefix;
-    unsigned long count;
-    const char * input;
-    int size;
-};
-
-static void * bc_salt_nogvl(void * ptr) {
-    struct bc_salt_args * args = ptr;
-
-    return crypt_gensalt_ra(args->prefix, args->count, args->input, args->size);
-}
-
 /* Given a logarithmic cost parameter, generates a salt for use with +bc_crypt+.
 */
 static VALUE bc_salt(VALUE self, VALUE prefix, VALUE count, VALUE input) {
     char * salt;
     VALUE str_salt;
-    struct bc_salt_args args;
-
-    /* duplicate the parameters for thread safety.  If another thread has a
-     * reference to the parameters and mutates them while we are working,
-     * that would be very bad.  Duping the strings means that the reference
-     * isn't shared. */
-    prefix = rb_str_new_frozen(prefix);
-    input  = rb_str_new_frozen(input);
-
-    args.prefix = StringValueCStr(prefix);
-    args.count  = NUM2ULONG(count);
-    args.input  = NIL_P(input) ? NULL : StringValuePtr(input);
-    args.size   = NIL_P(input) ? 0 : RSTRING_LEN(input);
-
-#ifdef HAVE_RUBY_THREAD_H
-    salt = rb_thread_call_without_gvl(bc_salt_nogvl, &args, NULL, NULL);
-#else
-    salt = bc_salt_nogvl((void *)&args);
-#endif
+
+    salt = crypt_gensalt_ra(
+	    StringValuePtr(prefix),
+	    NUM2ULONG(count),
+	    NIL_P(input) ? NULL : StringValuePtr(input),
+	    NIL_P(input) ? 0 : RSTRING_LEN(input));
 
     if(!salt) return Qnil;
 
@@ -54,52 +24,30 @@ static VALUE bc_salt(VALUE self, VALUE prefix, VALUE count, VALUE input) {
     return str_salt;
 }
 
-struct bc_crypt_args {
-    const char * key;
-    const char * setting;
-    void * data;
-    int size;
-};
-
-static void * bc_crypt_nogvl(void * ptr) {
-    struct bc_crypt_args * args = ptr;
-
-    return crypt_ra(args->key, args->setting, &args->data, &args->size);
-}
-
 /* Given a secret and a salt, generates a salted hash (which you can then store safely).
 */
 static VALUE bc_crypt(VALUE self, VALUE key, VALUE setting) {
     char * value;
+    void * data;
+    int size;
     VALUE out;
 
-    struct bc_crypt_args args;
+    data = NULL;
+    size = 0xDEADBEEF;
 
     if(NIL_P(key) || NIL_P(setting)) return Qnil;
 
-    /* duplicate the parameters for thread safety.  If another thread has a
-     * reference to the parameters and mutates them while we are working,
-     * that would be very bad.  Duping the strings means that the reference
-     * isn't shared. */
-    key     = rb_str_new_frozen(key);
-    setting = rb_str_new_frozen(setting);
-
-    args.data    = NULL;
-    args.size    = 0xDEADBEEF;
-    args.key     = NIL_P(key)     ? NULL : StringValueCStr(key);
-    args.setting = NIL_P(setting) ? NULL : StringValueCStr(setting);
-
-#ifdef HAVE_RUBY_THREAD_H
-    value = rb_thread_call_without_gvl(bc_crypt_nogvl, &args, NULL, NULL);
-#else
-    value = bc_crypt_nogvl((void *)&args);
-#endif
+    value = crypt_ra(
+	    NIL_P(key) ? NULL : StringValuePtr(key),
+	    NIL_P(setting) ? NULL : StringValuePtr(setting),
+	    &data,
+	    &size);
 
-    if(!value || !args.data) return Qnil;
+    if(!value || !data) return Qnil;
 
-    out = rb_str_new(args.data, args.size - 1);
+    out = rb_str_new2(value);
 
-    free(args.data);
+    xfree(data);
 
     return out;
 }

data/ext/mri/wrapper.c

@@ -179,7 +179,7 @@ char *crypt_ra(const char *key, const char *setting,
 	return _crypt_blowfish_rn(key, setting, (char *)*data, *size);
 }
 
-char *crypt_r(const char *key, const char *setting, void *data)
+char *crypt_r(const char *key, const char *setting, struct crypt_data *data)
 {
 	return _crypt_retval_magic(
 		crypt_rn(key, setting, data, CRYPT_OUTPUT_SIZE),

data/lib/bcrypt/engine.rb

@@ -7,6 +7,14 @@ module BCrypt
     MIN_COST        = 4
     # The maximum cost supported by the algorithm.
     MAX_COST = 31
+    # Maximum possible size of bcrypt() secrets.
+    # Older versions of the bcrypt library would truncate passwords longer
+    # than 72 bytes, but newer ones do not. We truncate like the old library for
+    # forward compatibility. This way users upgrading from Ubuntu 18.04 to 20.04
+    # will not have their user passwords invalidated, for example.
+    # A max secret length greater than 255 leads to bcrypt returning nil.
+    # https://github.com/bcrypt-ruby/bcrypt-ruby/issues/225#issuecomment-875908425
+    MAX_SECRET_BYTESIZE = 72
     # Maximum possible size of bcrypt() salts.
     MAX_SALT_LENGTH = 16
 
@@ -43,14 +51,16 @@ module BCrypt
     end
 
     # Given a secret and a valid salt (see BCrypt::Engine.generate_salt) calculates
-    # a bcrypt() password hash.
+    # a bcrypt() password hash. Secrets longer than 72 bytes are truncated.
     def self.hash_secret(secret, salt, _ = nil)
       if valid_secret?(secret)
         if valid_salt?(salt)
           if RUBY_PLATFORM == "java"
             Java.bcrypt_jruby.BCrypt.hashpw(secret.to_s.to_java_bytes, salt.to_s)
           else
-            __bc_crypt(secret.to_s, salt)
+            secret = secret.to_s
+            secret = secret.byteslice(0, MAX_SECRET_BYTESIZE) if secret && secret.bytesize > MAX_SECRET_BYTESIZE
+            __bc_crypt(secret, salt)
           end
         else
           raise Errors::InvalidSalt.new("invalid salt")
@@ -70,8 +80,7 @@ module BCrypt
         if RUBY_PLATFORM == "java"
           Java.bcrypt_jruby.BCrypt.gensalt(cost)
         else
-          prefix = "$2a$05$CCCCCCCCCCCCCCCCCCCCC.E5YPO9kmyuRGyh0XouQYb4YMJKvyOeW"
-          __bc_salt(prefix, cost, OpenSSL::Random.random_bytes(MAX_SALT_LENGTH))
+          __bc_salt("$2a$", cost, OpenSSL::Random.random_bytes(MAX_SALT_LENGTH))
         end
       else
         raise Errors::InvalidCost.new("cost must be numeric and > 0")
@@ -80,7 +89,7 @@ module BCrypt
 
     # Returns true if +salt+ is a valid bcrypt() salt, false if not.
     def self.valid_salt?(salt)
-      !!(salt =~ /^\$[0-9a-z]{2,}\$[0-9]{2,}\$[A-Za-z0-9\.\/]{22,}$/)
+      !!(salt =~ /\A\$[0-9a-z]{2,}\$[0-9]{2,}\$[A-Za-z0-9\.\/]{22,}\z/)
     end
 
     # Returns true if +secret+ is a valid bcrypt() secret, false if not.

data/lib/bcrypt/password.rb

@@ -47,7 +47,7 @@ module BCrypt
       end
 
       def valid_hash?(h)
-        h =~ /^\$[0-9a-z]{2}\$[0-9]{2}\$[A-Za-z0-9\.\/]{53}$/
+        /\A\$[0-9a-z]{2}\$[0-9]{2}\$[A-Za-z0-9\.\/]{53}\z/ === h
       end
     end
 
@@ -62,6 +62,17 @@ module BCrypt
     end
 
     # Compares a potential secret against the hash. Returns true if the secret is the original secret, false otherwise.
+    #
+    # Comparison edge case/gotcha:
+    #
+    #    secret = "my secret"
+    #    @password = BCrypt::Password.create(secret)
+    #
+    #    @password == secret              # => True
+    #    @password == @password           # => False
+    #    @password == @password.to_s      # => False
+    #    @password.to_s == @password      # => True
+    #    @password.to_s == @password.to_s # => True
     def ==(secret)
       super(BCrypt::Engine.hash_secret(secret, @salt))
     end
@@ -83,5 +94,4 @@ module BCrypt
       return v.to_str, c.to_i, h[0, 29].to_str, mash[-31, 31].to_str
     end
   end
-
 end

data/spec/bcrypt/engine_spec.rb

@@ -1,4 +1,5 @@
 require File.expand_path(File.join(File.dirname(__FILE__), "..", "spec_helper"))
+require 'securerandom'
 
 describe 'BCrypt::Engine' do
   describe '.calibrate(upper_time_limit_in_ms)' do
@@ -12,8 +13,11 @@ end
 
 describe "The BCrypt engine" do
   specify "should calculate the optimal cost factor to fit in a specific time" do
-    first = BCrypt::Engine.calibrate(100)
-    second = BCrypt::Engine.calibrate(400)
+    start_time = Time.now
+    BCrypt::Password.create("testing testing", :cost => BCrypt::Engine::MIN_COST + 1)
+    min_time_ms = (Time.now - start_time) * 1000
+    first = BCrypt::Engine.calibrate(min_time_ms)
+    second = BCrypt::Engine.calibrate(min_time_ms * 4)
     expect(second).to be > first
   end
 end
@@ -154,4 +158,19 @@ describe "Generating BCrypt hashes" do
       expect(BCrypt::Engine.hash_secret(secret, salt)).to eql(test_vector)
     end
   end
+
+  specify "should truncate long 1-byte character secrets to 72 bytes" do
+    # 'b' as a base triggers the failure at 256 characters, but 'a' does not.
+    too_long_secret = 'b'*(BCrypt::Engine::MAX_SECRET_BYTESIZE + 1)
+    just_right_secret = 'b'*BCrypt::Engine::MAX_SECRET_BYTESIZE
+    expect(BCrypt::Engine.hash_secret(too_long_secret, @salt)).to eq(BCrypt::Engine.hash_secret(just_right_secret, @salt))
+  end
+
+  specify "should truncate long multi-byte character secrets to 72 bytes" do
+    # 256 times causes bcrypt to return nil for libxcrypt > 4.4.18-4.
+    too_long_secret = '𐐷'*256
+    # 𐐷 takes 4 bytes in UTF-8. 18 times is 72 bytes
+    just_right_secret = '𐐷'*18
+    expect(BCrypt::Engine.hash_secret(too_long_secret, @salt)).to eq(BCrypt::Engine.hash_secret(just_right_secret, @salt))
+  end
 end

data/spec/bcrypt/password_spec.rb

@@ -1,4 +1,5 @@
 require File.expand_path(File.join(File.dirname(__FILE__), "..", "spec_helper"))
+require 'securerandom'
 
 describe "Creating a hashed password" do
 
@@ -26,6 +27,10 @@ describe "Creating a hashed password" do
     expect { BCrypt::Password.create( ""         ) }.not_to raise_error
     expect { BCrypt::Password.create( String.new ) }.not_to raise_error
   end
+
+  specify "should tolerate very long string secrets" do
+    expect { BCrypt::Password.create("abcd"*1024) }.not_to raise_error
+  end
 end
 
 describe "Reading a hashed password" do
@@ -108,6 +113,7 @@ end
 describe "Validating a generated salt" do
   specify "should not accept an invalid salt" do
     expect(BCrypt::Engine.valid_salt?("invalid")).to eq(false)
+    expect(BCrypt::Engine.valid_salt?("invalid\n#{BCrypt::Engine.generate_salt}\ninvalid")).to eq(false)
   end
   specify "should accept a valid salt" do
     expect(BCrypt::Engine.valid_salt?(BCrypt::Engine.generate_salt)).to eq(true)
@@ -116,9 +122,10 @@ end
 
 describe "Validating a password hash" do
   specify "should not accept an invalid password" do
-    expect(BCrypt::Password.valid_hash?("i_am_so_not_valid")).to be_falsey
+    expect(BCrypt::Password.valid_hash?("i_am_so_not_valid")).to be(false)
+    expect(BCrypt::Password.valid_hash?("invalid\n#{BCrypt::Password.create "i_am_so_valid"}\ninvalid")).to be(false)
   end
   specify "should accept a valid password" do
-    expect(BCrypt::Password.valid_hash?(BCrypt::Password.create "i_am_so_valid")).to be_truthy
+    expect(BCrypt::Password.valid_hash?(BCrypt::Password.create "i_am_so_valid")).to be(true)
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bcrypt
 version: !ruby/object:Gem::Version
-  version: 3.1.14
+  version: 3.1.17
 platform: java
 authors:
 - Coda Hale
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-07-21 00:00:00.000000000 Z
+date: 2022-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -17,8 +17,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.9.2
   name: rake-compiler
-  type: :development
   prerelease: false
+  type: :development
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -31,8 +31,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '3'
   name: rspec
-  type: :development
   prerelease: false
+  type: :development
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -54,13 +54,12 @@ extra_rdoc_files:
 - lib/bcrypt/engine.rb
 - lib/bcrypt/error.rb
 files:
+- ".github/workflows/ruby.yml"
 - ".gitignore"
 - ".rspec"
-- ".travis.yml"
 - CHANGELOG
 - COPYING
 - Gemfile
-- Gemfile.lock
 - README.md
 - Rakefile
 - appveyor.yml
@@ -87,7 +86,7 @@ files:
 - spec/bcrypt/error_spec.rb
 - spec/bcrypt/password_spec.rb
 - spec/spec_helper.rb
-homepage: https://github.com/codahale/bcrypt-ruby
+homepage: https://github.com/bcrypt-ruby/bcrypt-ruby
 licenses:
 - MIT
 metadata: {}
@@ -112,7 +111,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.6
+rubygems_version: 3.2.29
 signing_key:
 specification_version: 4
 summary: OpenBSD's bcrypt() password hashing algorithm.

data/.travis.yml

@@ -1,23 +0,0 @@
-language: ruby
-before_install:
-  - "echo 'gem: --no-rdoc --no-ri' > ~/.gemrc"
-  - gem update --system 2.7.8
-  - gem install bundler -v 1.17.3
-rvm:
-  - 2.0
-  - 2.1
-  - 2.2
-  - 2.3
-  - 2.4
-  - 2.5
-  - 2.6
-  - ruby-head
-  - jruby-head
-  - rbx-3
-matrix:
-  allow_failures:
-    - rvm: ruby-head
-    - rvm: jruby-head
-    - rvm: rbx-3
-  fast_finish: true
-script: bundle exec rake

data/Gemfile.lock

@@ -1,37 +0,0 @@
-PATH
-  remote: .
-  specs:
-    bcrypt (3.1.14)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    diff-lcs (1.4.4)
-    rake (13.0.1)
-    rake-compiler (0.9.9)
-      rake
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.2)
-      rspec-support (~> 3.9.3)
-    rspec-expectations (3.9.2)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.1)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.3)
-
-PLATFORMS
-  java
-  ruby
-
-DEPENDENCIES
-  bcrypt!
-  rake-compiler (~> 0.9.2)
-  rspec (>= 3)
-
-BUNDLED WITH
-   2.2.0.dev