bcrypt 3.1.7 → 3.1.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +17 -7
- data/.gitignore +4 -5
- data/.travis.yml +13 -7
- data/CHANGELOG +16 -0
- data/Gemfile.lock +22 -14
- data/README.md +57 -68
- data/Rakefile +30 -6
- data/appveyor.yml +50 -0
- data/bcrypt.gemspec +2 -2
- data/ext/mri/bcrypt_ext.c +1 -1
- data/ext/mri/extconf.rb +0 -1
- data/lib/bcrypt/password.rb +1 -1
- data/spec/bcrypt/engine_spec.rb +15 -15
- data/spec/bcrypt/error_spec.rb +2 -2
- data/spec/bcrypt/password_spec.rb +30 -29
- metadata +61 -48
checksums.yaml
CHANGED
|
@@ -1,7 +1,17 @@
|
|
|
1
|
-
---
|
|
2
|
-
|
|
3
|
-
metadata.gz:
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
1
|
+
---
|
|
2
|
+
!binary "U0hBMjU2":
|
|
3
|
+
metadata.gz: !binary |-
|
|
4
|
+
YjQwMDJlZTYyN2EzOTJhMzg3Y2YyMDgwYjZjYjdiOWRkNmNiZWRkYmMxNGVh
|
|
5
|
+
MzkyZDczMmIzOTNjYWMwNDI3ZQ==
|
|
6
|
+
data.tar.gz: !binary |-
|
|
7
|
+
MDdkNzlhOGZmYjNlNWMxODE3OTBhMmFiYWU3ZDFiNDA2N2M4YThhOWUxZTcy
|
|
8
|
+
YmEwZDE5ODg4ZWJhMjg5NWEzNg==
|
|
9
|
+
SHA512:
|
|
10
|
+
metadata.gz: !binary |-
|
|
11
|
+
YWFlMDYxYzFjM2NlNjY5YzhkZmVmYWIxNGI5NzFkNDgzZTdkYmViNmU4Mjhm
|
|
12
|
+
NmEzYjhiMjRlODA1ZDc2ZTRjNDQ3ODg4NzM1ZWI0YzIwNjU1YTZkZjE4MmQ3
|
|
13
|
+
Nzc1Y2IzZGM3YmZhOWQxYjI4OTBkY2RmMTE3MWZhZDhkYTQ4ZDA=
|
|
14
|
+
data.tar.gz: !binary |-
|
|
15
|
+
Njc0ODJhZWE3YTMwNTNhYmRlYjllYWZkYzM1YTg5OTU5NTAwNWYyMzU4ZWM2
|
|
16
|
+
ZmRlZmYyZGJlYWQ3NzcxNjNkOTNkODI5YTY4MTM1ZDllZGVmOTJmODNiNmRl
|
|
17
|
+
ZWRjZjRjOGRmM2FiNTM5M2I3MDBiYWYwN2NkNGZkNjZkYzI4ZjE=
|
data/.gitignore
CHANGED
data/.travis.yml
CHANGED
|
@@ -1,15 +1,21 @@
|
|
|
1
1
|
language: ruby
|
|
2
|
+
before_install:
|
|
3
|
+
- gem update --system
|
|
4
|
+
- gem install bundler
|
|
2
5
|
rvm:
|
|
3
|
-
- 1.8
|
|
4
|
-
- 1.9
|
|
5
|
-
-
|
|
6
|
-
- 2.
|
|
7
|
-
- 2.
|
|
6
|
+
- 1.8
|
|
7
|
+
- 1.9
|
|
8
|
+
- 2.0
|
|
9
|
+
- 2.1
|
|
10
|
+
- 2.2
|
|
11
|
+
- 2.3
|
|
12
|
+
- 2.4
|
|
13
|
+
- 2.5
|
|
14
|
+
- 2.6
|
|
8
15
|
- ruby-head
|
|
9
16
|
- jruby-18mode
|
|
10
17
|
- jruby-19mode
|
|
11
18
|
- jruby-head
|
|
12
|
-
- rbx-
|
|
13
|
-
- rbx
|
|
19
|
+
- rbx-3
|
|
14
20
|
- ree
|
|
15
21
|
script: bundle exec rake
|
data/CHANGELOG
CHANGED
|
@@ -70,3 +70,19 @@
|
|
|
70
70
|
3.1.7 Feb 24 2014
|
|
71
71
|
- Rebuild corrupt Java binary version of gem [GH #90]
|
|
72
72
|
- The 2.1 support for Windows binaries alleged in 3.1.3 was a lie -- documentation removed
|
|
73
|
+
|
|
74
|
+
3.1.8 Oct 23 2014
|
|
75
|
+
- Add support for Ruby 2.1 in compiled Windows binaries [GH #102]
|
|
76
|
+
|
|
77
|
+
3.1.9 Oct 23 2014
|
|
78
|
+
- Rebuild corrupt binaries
|
|
79
|
+
|
|
80
|
+
3.1.10 Jan 28 2015
|
|
81
|
+
- Fix issue with dumping a BCrypt::Password instance to YAML in Ruby 2.2 [GH #107 by @mattwildig]
|
|
82
|
+
|
|
83
|
+
3.1.11 Mar 06 2016
|
|
84
|
+
- Add support for Ruby 2.2 in compiled Windows binaries
|
|
85
|
+
|
|
86
|
+
3.1.12 May 16 2018
|
|
87
|
+
- Add support for Ruby 2.3, 2.4, and 2.5 in compiled Windows binaries
|
|
88
|
+
- Fix compatibility with libxcrypt [GH #164 by @besser82]
|
data/Gemfile.lock
CHANGED
|
@@ -1,27 +1,32 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
bcrypt (3.1.
|
|
4
|
+
bcrypt (3.1.12)
|
|
5
5
|
|
|
6
6
|
GEM
|
|
7
7
|
remote: https://rubygems.org/
|
|
8
8
|
specs:
|
|
9
9
|
diff-lcs (1.2.5)
|
|
10
|
-
json (1.8.
|
|
11
|
-
json (1.8.
|
|
12
|
-
rake (10.
|
|
13
|
-
rake-compiler (0.9.
|
|
10
|
+
json (1.8.6)
|
|
11
|
+
json (1.8.6-java)
|
|
12
|
+
rake (10.4.2)
|
|
13
|
+
rake-compiler (0.9.5)
|
|
14
14
|
rake
|
|
15
15
|
rdoc (3.12.2)
|
|
16
16
|
json (~> 1.4)
|
|
17
|
-
rspec (
|
|
18
|
-
rspec-core (~>
|
|
19
|
-
rspec-expectations (~>
|
|
20
|
-
rspec-mocks (~>
|
|
21
|
-
rspec-core (
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
17
|
+
rspec (3.3.0)
|
|
18
|
+
rspec-core (~> 3.3.0)
|
|
19
|
+
rspec-expectations (~> 3.3.0)
|
|
20
|
+
rspec-mocks (~> 3.3.0)
|
|
21
|
+
rspec-core (3.3.2)
|
|
22
|
+
rspec-support (~> 3.3.0)
|
|
23
|
+
rspec-expectations (3.3.1)
|
|
24
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
25
|
+
rspec-support (~> 3.3.0)
|
|
26
|
+
rspec-mocks (3.3.2)
|
|
27
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
28
|
+
rspec-support (~> 3.3.0)
|
|
29
|
+
rspec-support (3.3.0)
|
|
25
30
|
|
|
26
31
|
PLATFORMS
|
|
27
32
|
java
|
|
@@ -33,4 +38,7 @@ DEPENDENCIES
|
|
|
33
38
|
bcrypt!
|
|
34
39
|
rake-compiler (~> 0.9.2)
|
|
35
40
|
rdoc (~> 3.12)
|
|
36
|
-
rspec
|
|
41
|
+
rspec (>= 3)
|
|
42
|
+
|
|
43
|
+
BUNDLED WITH
|
|
44
|
+
1.16.1
|
data/README.md
CHANGED
|
@@ -30,8 +30,8 @@ re-hash those passwords. This vulnerability only affected the JRuby gem.
|
|
|
30
30
|
The bcrypt gem is available on the following ruby platforms:
|
|
31
31
|
|
|
32
32
|
* JRuby
|
|
33
|
-
* RubyInstaller 1.8, 1.9, and 2.
|
|
34
|
-
* Any 1.8, 1.9, 2.0, or 2.
|
|
33
|
+
* RubyInstaller 1.8, 1.9, 2.0, 2.1, 2.2, 2.3, 2.4, and 2.5 builds on Windows
|
|
34
|
+
* Any 1.8, 1.9, 2.0, 2.1, 2.2, 2.3, 2.4, or 2.5 Ruby on a BSD/OS X/Linux system with a compiler
|
|
35
35
|
|
|
36
36
|
## How to use `bcrypt()` in your Rails application
|
|
37
37
|
|
|
@@ -40,69 +40,58 @@ The bcrypt gem is available on the following ruby platforms:
|
|
|
40
40
|
implements a similar authentication strategy to the code below.
|
|
41
41
|
|
|
42
42
|
### The _User_ model
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
43
|
+
```ruby
|
|
44
|
+
require 'bcrypt'
|
|
45
|
+
|
|
46
|
+
class User < ActiveRecord::Base
|
|
47
|
+
# users.password_hash in the database is a :string
|
|
48
|
+
include BCrypt
|
|
49
|
+
|
|
50
|
+
def password
|
|
51
|
+
@password ||= Password.new(password_hash)
|
|
52
|
+
end
|
|
53
|
+
|
|
54
|
+
def password=(new_password)
|
|
55
|
+
@password = Password.create(new_password)
|
|
56
|
+
self.password_hash = @password
|
|
57
|
+
end
|
|
58
|
+
end
|
|
59
|
+
```
|
|
60
60
|
### Creating an account
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
61
|
+
```ruby
|
|
62
|
+
def create
|
|
63
|
+
@user = User.new(params[:user])
|
|
64
|
+
@user.password = params[:password]
|
|
65
|
+
@user.save!
|
|
66
|
+
end
|
|
67
|
+
```
|
|
68
68
|
### Authenticating a user
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
### If a user forgets their password?
|
|
80
|
-
|
|
81
|
-
# assign them a random one and mail it to them, asking them to change it
|
|
82
|
-
def forgot_password
|
|
83
|
-
@user = User.find_by_email(params[:email])
|
|
84
|
-
random_password = Array.new(10).map { (65 + rand(58)).chr }.join
|
|
85
|
-
@user.password = random_password
|
|
86
|
-
@user.save!
|
|
87
|
-
Mailer.create_and_deliver_password_change(@user, random_password)
|
|
88
|
-
end
|
|
89
|
-
|
|
69
|
+
```ruby
|
|
70
|
+
def login
|
|
71
|
+
@user = User.find_by_email(params[:email])
|
|
72
|
+
if @user.password == params[:password]
|
|
73
|
+
give_token
|
|
74
|
+
else
|
|
75
|
+
redirect_to home_url
|
|
76
|
+
end
|
|
77
|
+
end
|
|
78
|
+
```
|
|
90
79
|
## How to use bcrypt-ruby in general
|
|
80
|
+
```ruby
|
|
81
|
+
require 'bcrypt'
|
|
91
82
|
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
my_password = BCrypt::Password.create("my password")
|
|
95
|
-
#=> "$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa"
|
|
96
|
-
|
|
97
|
-
my_password.version #=> "2a"
|
|
98
|
-
my_password.cost #=> 10
|
|
99
|
-
my_password == "my password" #=> true
|
|
100
|
-
my_password == "not my password" #=> false
|
|
83
|
+
my_password = BCrypt::Password.create("my password")
|
|
84
|
+
#=> "$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa"
|
|
101
85
|
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
86
|
+
my_password.version #=> "2a"
|
|
87
|
+
my_password.cost #=> 10
|
|
88
|
+
my_password == "my password" #=> true
|
|
89
|
+
my_password == "not my password" #=> false
|
|
105
90
|
|
|
91
|
+
my_password = BCrypt::Password.new("$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa")
|
|
92
|
+
my_password == "my password" #=> true
|
|
93
|
+
my_password == "not my password" #=> false
|
|
94
|
+
```
|
|
106
95
|
Check the rdocs for more details -- BCrypt, BCrypt::Password.
|
|
107
96
|
|
|
108
97
|
## How `bcrypt()` works
|
|
@@ -171,15 +160,15 @@ stateless authentication architecture (e.g., HTTP Basic Auth), you will want to
|
|
|
171
160
|
server load and keep your request times down. This will lower the security provided you, but there are few alternatives.
|
|
172
161
|
|
|
173
162
|
To change the default cost factor used by bcrypt-ruby, use `BCrypt::Engine.cost = new_value`:
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
163
|
+
```ruby
|
|
164
|
+
BCrypt::Password.create('secret').cost
|
|
165
|
+
#=> 10, the default provided by bcrypt-ruby
|
|
166
|
+
|
|
167
|
+
# set a new default cost
|
|
168
|
+
BCrypt::Engine.cost = 8
|
|
169
|
+
BCrypt::Password.create('secret').cost
|
|
170
|
+
#=> 8
|
|
171
|
+
```
|
|
183
172
|
The default cost can be overridden as needed by passing an options hash with a different cost:
|
|
184
173
|
|
|
185
174
|
BCrypt::Password.create('secret', :cost => 6).cost #=> 6
|
data/Rakefile
CHANGED
|
@@ -7,16 +7,23 @@ require 'rdoc/task'
|
|
|
7
7
|
require 'benchmark'
|
|
8
8
|
|
|
9
9
|
CLEAN.include(
|
|
10
|
-
"
|
|
11
|
-
"
|
|
12
|
-
"
|
|
13
|
-
"
|
|
10
|
+
"tmp",
|
|
11
|
+
"lib/1.8",
|
|
12
|
+
"lib/1.9",
|
|
13
|
+
"lib/2.0",
|
|
14
|
+
"lib/2.1",
|
|
15
|
+
"lib/2.2",
|
|
16
|
+
"lib/2.3",
|
|
17
|
+
"lib/2.4",
|
|
18
|
+
"lib/2.5",
|
|
19
|
+
"lib/bcrypt_ext.jar",
|
|
20
|
+
"lib/bcrypt_ext.so"
|
|
14
21
|
)
|
|
15
22
|
CLOBBER.include(
|
|
16
|
-
"
|
|
17
|
-
"doc/coverage",
|
|
23
|
+
"doc",
|
|
18
24
|
"pkg"
|
|
19
25
|
)
|
|
26
|
+
|
|
20
27
|
GEMSPEC = Gem::Specification.load("bcrypt.gemspec")
|
|
21
28
|
|
|
22
29
|
task :default => [:compile, :spec]
|
|
@@ -58,6 +65,23 @@ else
|
|
|
58
65
|
ext.cross_compile = true
|
|
59
66
|
ext.cross_platform = ['x86-mingw32', 'x64-mingw32']
|
|
60
67
|
end
|
|
68
|
+
|
|
69
|
+
ENV['RUBY_CC_VERSION'].to_s.split(':').each do |ruby_version|
|
|
70
|
+
platforms = {
|
|
71
|
+
"x86-mingw32" => "i686-w64-mingw32",
|
|
72
|
+
"x64-mingw32" => "x86_64-w64-mingw32"
|
|
73
|
+
}
|
|
74
|
+
platforms.each do |platform, prefix|
|
|
75
|
+
task "copy:bcrypt_ext:#{platform}:#{ruby_version}" do |t|
|
|
76
|
+
%w[lib tmp/#{platform}/stage/lib].each do |dir|
|
|
77
|
+
so_file = "#{dir}/#{ruby_version[/^\d+\.\d+/]}/bcrypt_ext.so"
|
|
78
|
+
if File.exists?(so_file)
|
|
79
|
+
sh "#{prefix}-strip -S #{so_file}"
|
|
80
|
+
end
|
|
81
|
+
end
|
|
82
|
+
end
|
|
83
|
+
end
|
|
84
|
+
end
|
|
61
85
|
end
|
|
62
86
|
|
|
63
87
|
desc "Run a set of benchmarks on the compiled extension."
|
data/appveyor.yml
ADDED
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
###############################################################################
|
|
2
|
+
#
|
|
3
|
+
# This AppVeyor config is *NOT* for running the tests on Windows.
|
|
4
|
+
#
|
|
5
|
+
# This is to ensure that the latest version of the bcrypt gem can be installed
|
|
6
|
+
# on Windows across all of the currently supported versions of Ruby.
|
|
7
|
+
#
|
|
8
|
+
###############################################################################
|
|
9
|
+
|
|
10
|
+
version: "{branch}-{build}"
|
|
11
|
+
build: off
|
|
12
|
+
clone_depth: 1
|
|
13
|
+
|
|
14
|
+
init:
|
|
15
|
+
# Install Ruby 1.8.7
|
|
16
|
+
- if %RUBY_VERSION%==187 (
|
|
17
|
+
appveyor DownloadFile https://dl.bintray.com/oneclick/rubyinstaller/rubyinstaller-1.8.7-p374.exe -FileName C:\ruby_187.exe &
|
|
18
|
+
C:\ruby_187.exe /verysilent /dir=C:\Ruby%RUBY_VERSION%
|
|
19
|
+
)
|
|
20
|
+
|
|
21
|
+
environment:
|
|
22
|
+
matrix:
|
|
23
|
+
- RUBY_VERSION: "187"
|
|
24
|
+
- RUBY_VERSION: "193"
|
|
25
|
+
- RUBY_VERSION: "200"
|
|
26
|
+
- RUBY_VERSION: "200-x64"
|
|
27
|
+
- RUBY_VERSION: "21"
|
|
28
|
+
- RUBY_VERSION: "21-x64"
|
|
29
|
+
- RUBY_VERSION: "22"
|
|
30
|
+
- RUBY_VERSION: "22-x64"
|
|
31
|
+
- RUBY_VERSION: "23"
|
|
32
|
+
- RUBY_VERSION: "23-x64"
|
|
33
|
+
- RUBY_VERSION: "24"
|
|
34
|
+
- RUBY_VERSION: "24-x64"
|
|
35
|
+
- RUBY_VERSION: "25"
|
|
36
|
+
- RUBY_VERSION: "25-x64"
|
|
37
|
+
|
|
38
|
+
install:
|
|
39
|
+
- set PATH=C:\Ruby%RUBY_VERSION%\bin;%PATH%
|
|
40
|
+
- if %RUBY_VERSION%==187 (
|
|
41
|
+
gem update --system 2.0.17
|
|
42
|
+
)
|
|
43
|
+
|
|
44
|
+
before_test:
|
|
45
|
+
- ruby -v
|
|
46
|
+
- gem -v
|
|
47
|
+
|
|
48
|
+
test_script:
|
|
49
|
+
- gem install bcrypt --prerelease --no-ri --no-rdoc
|
|
50
|
+
- ruby -e "require 'rubygems'; require 'bcrypt'"
|
data/bcrypt.gemspec
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Gem::Specification.new do |s|
|
|
2
2
|
s.name = 'bcrypt'
|
|
3
|
-
s.version = '3.1.
|
|
3
|
+
s.version = '3.1.12'
|
|
4
4
|
|
|
5
5
|
s.summary = "OpenBSD's bcrypt() password hashing algorithm."
|
|
6
6
|
s.description = <<-EOF
|
|
@@ -13,7 +13,7 @@ Gem::Specification.new do |s|
|
|
|
13
13
|
s.require_path = 'lib'
|
|
14
14
|
|
|
15
15
|
s.add_development_dependency 'rake-compiler', '~> 0.9.2'
|
|
16
|
-
s.add_development_dependency 'rspec'
|
|
16
|
+
s.add_development_dependency 'rspec', '>= 3'
|
|
17
17
|
s.add_development_dependency 'rdoc', '~> 3.12'
|
|
18
18
|
|
|
19
19
|
s.has_rdoc = true
|
data/ext/mri/bcrypt_ext.c
CHANGED
data/ext/mri/extconf.rb
CHANGED
data/lib/bcrypt/password.rb
CHANGED
|
@@ -80,7 +80,7 @@ module BCrypt
|
|
|
80
80
|
# Splits +h+ into version, cost, salt, and hash and returns them in that order.
|
|
81
81
|
def split_hash(h)
|
|
82
82
|
_, v, c, mash = h.split('$')
|
|
83
|
-
return v, c.to_i, h[0, 29].to_str, mash[-31, 31].to_str
|
|
83
|
+
return v.to_str, c.to_i, h[0, 29].to_str, mash[-31, 31].to_str
|
|
84
84
|
end
|
|
85
85
|
end
|
|
86
86
|
|
data/spec/bcrypt/engine_spec.rb
CHANGED
|
@@ -4,35 +4,35 @@ describe "The BCrypt engine" do
|
|
|
4
4
|
specify "should calculate the optimal cost factor to fit in a specific time" do
|
|
5
5
|
first = BCrypt::Engine.calibrate(100)
|
|
6
6
|
second = BCrypt::Engine.calibrate(400)
|
|
7
|
-
second.
|
|
7
|
+
expect(second).to be > first
|
|
8
8
|
end
|
|
9
9
|
end
|
|
10
10
|
|
|
11
11
|
describe "Generating BCrypt salts" do
|
|
12
12
|
|
|
13
13
|
specify "should produce strings" do
|
|
14
|
-
BCrypt::Engine.generate_salt.
|
|
14
|
+
expect(BCrypt::Engine.generate_salt).to be_an_instance_of(String)
|
|
15
15
|
end
|
|
16
16
|
|
|
17
17
|
specify "should produce random data" do
|
|
18
|
-
BCrypt::Engine.generate_salt.
|
|
18
|
+
expect(BCrypt::Engine.generate_salt).to_not equal(BCrypt::Engine.generate_salt)
|
|
19
19
|
end
|
|
20
20
|
|
|
21
21
|
specify "should raise a InvalidCostError if the cost parameter isn't numeric" do
|
|
22
|
-
|
|
22
|
+
expect { BCrypt::Engine.generate_salt('woo') }.to raise_error(BCrypt::Errors::InvalidCost)
|
|
23
23
|
end
|
|
24
24
|
|
|
25
25
|
specify "should raise a InvalidCostError if the cost parameter isn't greater than 0" do
|
|
26
|
-
|
|
26
|
+
expect { BCrypt::Engine.generate_salt(-1) }.to raise_error(BCrypt::Errors::InvalidCost)
|
|
27
27
|
end
|
|
28
28
|
end
|
|
29
29
|
|
|
30
30
|
describe "Autodetecting of salt cost" do
|
|
31
31
|
|
|
32
32
|
specify "should work" do
|
|
33
|
-
BCrypt::Engine.autodetect_cost("$2a$08$hRx2IVeHNsTSYYtUWn61Ou").
|
|
34
|
-
BCrypt::Engine.autodetect_cost("$2a$05$XKd1bMnLgUnc87qvbAaCUu").
|
|
35
|
-
BCrypt::Engine.autodetect_cost("$2a$13$Lni.CZ6z5A7344POTFBBV.").
|
|
33
|
+
expect(BCrypt::Engine.autodetect_cost("$2a$08$hRx2IVeHNsTSYYtUWn61Ou")).to eq 8
|
|
34
|
+
expect(BCrypt::Engine.autodetect_cost("$2a$05$XKd1bMnLgUnc87qvbAaCUu")).to eq 5
|
|
35
|
+
expect(BCrypt::Engine.autodetect_cost("$2a$13$Lni.CZ6z5A7344POTFBBV.")).to eq 13
|
|
36
36
|
end
|
|
37
37
|
|
|
38
38
|
end
|
|
@@ -49,21 +49,21 @@ describe "Generating BCrypt hashes" do
|
|
|
49
49
|
end
|
|
50
50
|
|
|
51
51
|
specify "should produce a string" do
|
|
52
|
-
BCrypt::Engine.hash_secret(@password, @salt).
|
|
52
|
+
expect(BCrypt::Engine.hash_secret(@password, @salt)).to be_an_instance_of(String)
|
|
53
53
|
end
|
|
54
54
|
|
|
55
55
|
specify "should raise an InvalidSalt error if the salt is invalid" do
|
|
56
|
-
|
|
56
|
+
expect { BCrypt::Engine.hash_secret(@password, 'nino') }.to raise_error(BCrypt::Errors::InvalidSalt)
|
|
57
57
|
end
|
|
58
58
|
|
|
59
59
|
specify "should raise an InvalidSecret error if the secret is invalid" do
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
60
|
+
expect { BCrypt::Engine.hash_secret(MyInvalidSecret.new, @salt) }.to raise_error(BCrypt::Errors::InvalidSecret)
|
|
61
|
+
expect { BCrypt::Engine.hash_secret(nil, @salt) }.not_to raise_error
|
|
62
|
+
expect { BCrypt::Engine.hash_secret(false, @salt) }.not_to raise_error
|
|
63
63
|
end
|
|
64
64
|
|
|
65
65
|
specify "should call #to_s on the secret and use the return value as the actual secret data" do
|
|
66
|
-
BCrypt::Engine.hash_secret(false, @salt).
|
|
66
|
+
expect(BCrypt::Engine.hash_secret(false, @salt)).to eq BCrypt::Engine.hash_secret("false", @salt)
|
|
67
67
|
end
|
|
68
68
|
|
|
69
69
|
specify "should be interoperable with other implementations" do
|
|
@@ -76,7 +76,7 @@ describe "Generating BCrypt hashes" do
|
|
|
76
76
|
["0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789", "$2a$05$abcdefghijklmnopqrstuu", "$2a$05$abcdefghijklmnopqrstuu5s2v8.iXieOjg/.AySBTTZIIVFJeBui"]
|
|
77
77
|
]
|
|
78
78
|
for secret, salt, test_vector in test_vectors
|
|
79
|
-
BCrypt::Engine.hash_secret(secret, salt).
|
|
79
|
+
expect(BCrypt::Engine.hash_secret(secret, salt)).to eql(test_vector)
|
|
80
80
|
end
|
|
81
81
|
end
|
|
82
82
|
end
|
data/spec/bcrypt/error_spec.rb
CHANGED
|
@@ -4,13 +4,13 @@ describe "Errors" do
|
|
|
4
4
|
|
|
5
5
|
shared_examples "descends from StandardError" do
|
|
6
6
|
it "can be rescued as a StandardError" do
|
|
7
|
-
described_class.
|
|
7
|
+
expect(described_class).to be < StandardError
|
|
8
8
|
end
|
|
9
9
|
end
|
|
10
10
|
|
|
11
11
|
shared_examples "descends from BCrypt::Error" do
|
|
12
12
|
it "can be rescued as a BCrypt::Error" do
|
|
13
|
-
described_class.
|
|
13
|
+
expect(described_class).to be < BCrypt::Error
|
|
14
14
|
end
|
|
15
15
|
end
|
|
16
16
|
|
|
@@ -8,23 +8,23 @@ describe "Creating a hashed password" do
|
|
|
8
8
|
end
|
|
9
9
|
|
|
10
10
|
specify "should return a BCrypt::Password" do
|
|
11
|
-
@password.
|
|
11
|
+
expect(@password).to be_an_instance_of(BCrypt::Password)
|
|
12
12
|
end
|
|
13
13
|
|
|
14
14
|
specify "should return a valid bcrypt password" do
|
|
15
|
-
|
|
15
|
+
expect { BCrypt::Password.new(@password) }.not_to raise_error
|
|
16
16
|
end
|
|
17
17
|
|
|
18
18
|
specify "should behave normally if the secret is not a string" do
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
19
|
+
expect { BCrypt::Password.create(nil) }.not_to raise_error
|
|
20
|
+
expect { BCrypt::Password.create({:woo => "yeah"}) }.not_to raise_error
|
|
21
|
+
expect { BCrypt::Password.create(false) }.not_to raise_error
|
|
22
22
|
end
|
|
23
23
|
|
|
24
24
|
specify "should tolerate empty string secrets" do
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
25
|
+
expect { BCrypt::Password.create( "\n".chop ) }.not_to raise_error
|
|
26
|
+
expect { BCrypt::Password.create( "" ) }.not_to raise_error
|
|
27
|
+
expect { BCrypt::Password.create( String.new ) }.not_to raise_error
|
|
28
28
|
end
|
|
29
29
|
end
|
|
30
30
|
|
|
@@ -35,26 +35,26 @@ describe "Reading a hashed password" do
|
|
|
35
35
|
end
|
|
36
36
|
|
|
37
37
|
specify "the cost is too damn high" do
|
|
38
|
-
|
|
38
|
+
expect {
|
|
39
39
|
BCrypt::Password.create("hello", :cost => 32)
|
|
40
|
-
}.
|
|
40
|
+
}.to raise_error(ArgumentError)
|
|
41
41
|
end
|
|
42
42
|
|
|
43
43
|
specify "the cost should be set to the default if nil" do
|
|
44
|
-
BCrypt::Password.create("hello", :cost => nil).cost.
|
|
44
|
+
expect(BCrypt::Password.create("hello", :cost => nil).cost).to equal(BCrypt::Engine::DEFAULT_COST)
|
|
45
45
|
end
|
|
46
46
|
|
|
47
47
|
specify "the cost should be set to the default if empty hash" do
|
|
48
|
-
BCrypt::Password.create("hello", {}).cost.
|
|
48
|
+
expect(BCrypt::Password.create("hello", {}).cost).to equal(BCrypt::Engine::DEFAULT_COST)
|
|
49
49
|
end
|
|
50
50
|
|
|
51
51
|
specify "the cost should be set to the passed value if provided" do
|
|
52
|
-
BCrypt::Password.create("hello", :cost => 5).cost.
|
|
52
|
+
expect(BCrypt::Password.create("hello", :cost => 5).cost).to equal(5)
|
|
53
53
|
end
|
|
54
54
|
|
|
55
55
|
specify "the cost should be set to the global value if set" do
|
|
56
56
|
BCrypt::Engine.cost = 5
|
|
57
|
-
BCrypt::Password.create("hello").cost.
|
|
57
|
+
expect(BCrypt::Password.create("hello").cost).to equal(5)
|
|
58
58
|
# unset the global value to not affect other tests
|
|
59
59
|
BCrypt::Engine.cost = nil
|
|
60
60
|
end
|
|
@@ -65,7 +65,7 @@ describe "Reading a hashed password" do
|
|
|
65
65
|
old_default_cost = BCrypt::Engine::DEFAULT_COST
|
|
66
66
|
|
|
67
67
|
BCrypt::Engine::DEFAULT_COST = 5
|
|
68
|
-
BCrypt::Password.create("hello").cost.
|
|
68
|
+
expect(BCrypt::Password.create("hello").cost).to equal(5)
|
|
69
69
|
|
|
70
70
|
# reset default to not affect other tests
|
|
71
71
|
BCrypt::Engine::DEFAULT_COST = old_default_cost
|
|
@@ -74,17 +74,18 @@ describe "Reading a hashed password" do
|
|
|
74
74
|
|
|
75
75
|
specify "should read the version, cost, salt, and hash" do
|
|
76
76
|
password = BCrypt::Password.new(@hash)
|
|
77
|
-
password.version.
|
|
78
|
-
password.
|
|
79
|
-
password.
|
|
80
|
-
password.salt.
|
|
81
|
-
password.
|
|
82
|
-
password.checksum.
|
|
83
|
-
password.
|
|
77
|
+
expect(password.version).to eql("2a")
|
|
78
|
+
expect(password.version.class).to eq String
|
|
79
|
+
expect(password.cost).to equal(5)
|
|
80
|
+
expect(password.salt).to eql("$2a$05$CCCCCCCCCCCCCCCCCCCCC.")
|
|
81
|
+
expect(password.salt.class).to eq String
|
|
82
|
+
expect(password.checksum).to eq("E5YPO9kmyuRGyh0XouQYb4YMJKvyOeW")
|
|
83
|
+
expect(password.checksum.class).to eq String
|
|
84
|
+
expect(password.to_s).to eql(@hash)
|
|
84
85
|
end
|
|
85
86
|
|
|
86
87
|
specify "should raise an InvalidHashError when given an invalid hash" do
|
|
87
|
-
|
|
88
|
+
expect { BCrypt::Password.new('weedle') }.to raise_error(BCrypt::Errors::InvalidHash)
|
|
88
89
|
end
|
|
89
90
|
end
|
|
90
91
|
|
|
@@ -96,28 +97,28 @@ describe "Comparing a hashed password with a secret" do
|
|
|
96
97
|
end
|
|
97
98
|
|
|
98
99
|
specify "should compare successfully to the original secret" do
|
|
99
|
-
(@password == @secret).
|
|
100
|
+
expect((@password == @secret)).to be(true)
|
|
100
101
|
end
|
|
101
102
|
|
|
102
103
|
specify "should compare unsuccessfully to anything besides original secret" do
|
|
103
|
-
(@password == "@secret").
|
|
104
|
+
expect((@password == "@secret")).to be(false)
|
|
104
105
|
end
|
|
105
106
|
end
|
|
106
107
|
|
|
107
108
|
describe "Validating a generated salt" do
|
|
108
109
|
specify "should not accept an invalid salt" do
|
|
109
|
-
BCrypt::Engine.valid_salt?("invalid").
|
|
110
|
+
expect(BCrypt::Engine.valid_salt?("invalid")).to eq(false)
|
|
110
111
|
end
|
|
111
112
|
specify "should accept a valid salt" do
|
|
112
|
-
BCrypt::Engine.valid_salt?(BCrypt::Engine.generate_salt).
|
|
113
|
+
expect(BCrypt::Engine.valid_salt?(BCrypt::Engine.generate_salt)).to eq(true)
|
|
113
114
|
end
|
|
114
115
|
end
|
|
115
116
|
|
|
116
117
|
describe "Validating a password hash" do
|
|
117
118
|
specify "should not accept an invalid password" do
|
|
118
|
-
BCrypt::Password.valid_hash?("i_am_so_not_valid").
|
|
119
|
+
expect(BCrypt::Password.valid_hash?("i_am_so_not_valid")).to be_falsey
|
|
119
120
|
end
|
|
120
121
|
specify "should accept a valid password" do
|
|
121
|
-
BCrypt::Password.valid_hash?(BCrypt::Password.create "i_am_so_valid").
|
|
122
|
+
expect(BCrypt::Password.valid_hash?(BCrypt::Password.create "i_am_so_valid")).to be_truthy
|
|
122
123
|
end
|
|
123
124
|
end
|
metadata
CHANGED
|
@@ -1,62 +1,73 @@
|
|
|
1
|
-
--- !ruby/object:Gem::Specification
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: bcrypt
|
|
3
|
-
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 3.1.
|
|
3
|
+
version: !ruby/object:Gem::Version
|
|
4
|
+
version: 3.1.12
|
|
5
5
|
platform: ruby
|
|
6
|
-
authors:
|
|
6
|
+
authors:
|
|
7
7
|
- Coda Hale
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
- !ruby/object:Gem::Dependency
|
|
11
|
+
date: 2018-05-16 00:00:00.000000000 Z
|
|
12
|
+
dependencies:
|
|
13
|
+
- !ruby/object:Gem::Dependency
|
|
15
14
|
name: rake-compiler
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
requirements:
|
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
|
16
|
+
requirements:
|
|
19
17
|
- - ~>
|
|
20
|
-
- !ruby/object:Gem::Version
|
|
18
|
+
- !ruby/object:Gem::Version
|
|
21
19
|
version: 0.9.2
|
|
22
20
|
type: :development
|
|
23
|
-
version_requirements: *id001
|
|
24
|
-
- !ruby/object:Gem::Dependency
|
|
25
|
-
name: rspec
|
|
26
21
|
prerelease: false
|
|
27
|
-
|
|
28
|
-
requirements:
|
|
29
|
-
-
|
|
30
|
-
-
|
|
31
|
-
|
|
32
|
-
|
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
23
|
+
requirements:
|
|
24
|
+
- - ~>
|
|
25
|
+
- !ruby/object:Gem::Version
|
|
26
|
+
version: 0.9.2
|
|
27
|
+
- !ruby/object:Gem::Dependency
|
|
28
|
+
name: rspec
|
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
|
30
|
+
requirements:
|
|
31
|
+
- - ! '>='
|
|
32
|
+
- !ruby/object:Gem::Version
|
|
33
|
+
version: '3'
|
|
33
34
|
type: :development
|
|
34
|
-
version_requirements: *id002
|
|
35
|
-
- !ruby/object:Gem::Dependency
|
|
36
|
-
name: rdoc
|
|
37
35
|
prerelease: false
|
|
38
|
-
|
|
39
|
-
requirements:
|
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
37
|
+
requirements:
|
|
38
|
+
- - ! '>='
|
|
39
|
+
- !ruby/object:Gem::Version
|
|
40
|
+
version: '3'
|
|
41
|
+
- !ruby/object:Gem::Dependency
|
|
42
|
+
name: rdoc
|
|
43
|
+
requirement: !ruby/object:Gem::Requirement
|
|
44
|
+
requirements:
|
|
40
45
|
- - ~>
|
|
41
|
-
- !ruby/object:Gem::Version
|
|
42
|
-
version:
|
|
46
|
+
- !ruby/object:Gem::Version
|
|
47
|
+
version: '3.12'
|
|
43
48
|
type: :development
|
|
44
|
-
|
|
45
|
-
|
|
49
|
+
prerelease: false
|
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
51
|
+
requirements:
|
|
52
|
+
- - ~>
|
|
53
|
+
- !ruby/object:Gem::Version
|
|
54
|
+
version: '3.12'
|
|
55
|
+
description: ! " bcrypt() is a sophisticated and secure hash algorithm designed
|
|
56
|
+
by The OpenBSD project\n for hashing passwords. The bcrypt Ruby gem provides
|
|
57
|
+
a simple wrapper for safely handling\n passwords.\n"
|
|
46
58
|
email: coda.hale@gmail.com
|
|
47
59
|
executables: []
|
|
48
|
-
|
|
49
|
-
extensions:
|
|
60
|
+
extensions:
|
|
50
61
|
- ext/mri/extconf.rb
|
|
51
|
-
extra_rdoc_files:
|
|
62
|
+
extra_rdoc_files:
|
|
52
63
|
- README.md
|
|
53
64
|
- COPYING
|
|
54
65
|
- CHANGELOG
|
|
66
|
+
- lib/bcrypt/password.rb
|
|
55
67
|
- lib/bcrypt/engine.rb
|
|
56
68
|
- lib/bcrypt/error.rb
|
|
57
|
-
- lib/bcrypt/password.rb
|
|
58
69
|
- lib/bcrypt.rb
|
|
59
|
-
files:
|
|
70
|
+
files:
|
|
60
71
|
- .gitignore
|
|
61
72
|
- .rspec
|
|
62
73
|
- .travis.yml
|
|
@@ -66,6 +77,7 @@ files:
|
|
|
66
77
|
- Gemfile.lock
|
|
67
78
|
- README.md
|
|
68
79
|
- Rakefile
|
|
80
|
+
- appveyor.yml
|
|
69
81
|
- bcrypt.gemspec
|
|
70
82
|
- ext/jruby/bcrypt_jruby/BCrypt.java
|
|
71
83
|
- ext/mri/bcrypt_ext.c
|
|
@@ -86,32 +98,33 @@ files:
|
|
|
86
98
|
- spec/bcrypt/password_spec.rb
|
|
87
99
|
- spec/spec_helper.rb
|
|
88
100
|
homepage: https://github.com/codahale/bcrypt-ruby
|
|
89
|
-
licenses:
|
|
101
|
+
licenses:
|
|
90
102
|
- MIT
|
|
91
103
|
metadata: {}
|
|
92
|
-
|
|
93
104
|
post_install_message:
|
|
94
|
-
rdoc_options:
|
|
105
|
+
rdoc_options:
|
|
95
106
|
- --title
|
|
96
107
|
- bcrypt-ruby
|
|
97
108
|
- --line-numbers
|
|
98
109
|
- --inline-source
|
|
99
110
|
- --main
|
|
100
111
|
- README.md
|
|
101
|
-
require_paths:
|
|
112
|
+
require_paths:
|
|
102
113
|
- lib
|
|
103
|
-
required_ruby_version: !ruby/object:Gem::Requirement
|
|
104
|
-
requirements:
|
|
105
|
-
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
114
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
|
115
|
+
requirements:
|
|
116
|
+
- - ! '>='
|
|
117
|
+
- !ruby/object:Gem::Version
|
|
118
|
+
version: '0'
|
|
119
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
120
|
+
requirements:
|
|
121
|
+
- - ! '>='
|
|
122
|
+
- !ruby/object:Gem::Version
|
|
123
|
+
version: '0'
|
|
109
124
|
requirements: []
|
|
110
|
-
|
|
111
125
|
rubyforge_project:
|
|
112
|
-
rubygems_version: 2.
|
|
126
|
+
rubygems_version: 2.7.6
|
|
113
127
|
signing_key:
|
|
114
128
|
specification_version: 4
|
|
115
129
|
summary: OpenBSD's bcrypt() password hashing algorithm.
|
|
116
130
|
test_files: []
|
|
117
|
-
|