Using bcrypt and plaintext schemes together may cause a ValueError exception
Created originally on Bitbucket by Anonymous
If the plaintext password happens to start with the prefix that identifies bcrypt, it fails with a ValueError. This snippet reproduces the issue:
#!python from passlib.context import CryptContext passlib_ctx = CryptContext(schemes=[ "bcrypt", "plaintext", ]) plaintext = 'potato' hashed = passlib_ctx.encrypt(plaintext) #problematic_plaintext = '$2a$12$D2ZnWsBaBEJzWxmYK3.A' #problematic_plaintext = '$2a$12$D7Q0W92sodO2FsqcBYAnnuueFC6bqg1abhMBKfJNGw4l4A0BsR' #problematic_plaintext = '$2a$12$D' #problematic_plaintext = '$2a$12' problematic_plaintext = '$2a$' assert passlib_ctx.verify(plaintext, plaintext) assert passlib_ctx.verify(plaintext, hashed) assert passlib_ctx.verify(problematic_plaintext, problematic_plaintext)
I'm not sure how that could be solved. Would catching the ValueError to try the plaintext scheme only be a good idea? This would reduce the possibility of a clash to the case of a plaintext password that is a valid a bcrypt hash. It does not sound like a good idea from a security perspective.
Should I consider this a non-issue if I make sure that all my users are not using a password that clashes with the bcrypt prefix? Or is it something that should be fixed in the library itself?
This probably affects other hash handlers.