-
Notifications
You must be signed in to change notification settings - Fork 22
Open
Description
When using https://pkg.go.dev/bytes#SplitN as part of the Decode step for Verify
call, the $<id>[$<param>=<value>(,<param>=<value>)*][$<salt>[$<hash>]]
formatted string is not properly split, leading into incorrect results for Verify
See: https://play.golang.org/p/Pk8URcLJxmx
For a hash string like this, the results in a tokens array that has incorrectly combined the hash with the salt. $6$rounds=10000$mysalt$9XTP7570fxVN/uTspSrH6kRPdR4KKGzGz7.TmJjDYGrKSwZuavW/3YaLur8JX6WP75Czcxa.megIO0lKreY0R.
Thus, call at https://github.com/GehirnInc/crypt/blob/master/common/salt.go#L125 incorrectly parses the salt, leading to error in the Verification.
Metadata
Metadata
Assignees
Labels
No labels