Using bcrypt and plaintext schemes together may cause a ValueError exception
Created originally on Bitbucket by Anonymous
If the plaintext password happens to start with the prefix that identifies bcrypt, it fails with a ValueError. This snippet reproduces the issue:
#!python
from passlib.context import CryptContext
passlib_ctx = CryptContext(schemes=[
"bcrypt",
"plaintext",
])
plaintext = 'potato'
hashed = passlib_ctx.encrypt(plaintext)
#problematic_plaintext = '$2a$12$D2ZnWsBaBEJzWxmYK3.A'
#problematic_plaintext = '$2a$12$D7Q0W92sodO2FsqcBYAnnuueFC6bqg1abhMBKfJNGw4l4A0BsR'
#problematic_plaintext = '$2a$12$D'
#problematic_plaintext = '$2a$12'
problematic_plaintext = '$2a$'
assert passlib_ctx.verify(plaintext, plaintext)
assert passlib_ctx.verify(plaintext, hashed)
assert passlib_ctx.verify(problematic_plaintext, problematic_plaintext)
I'm not sure how that could be solved. Would catching the ValueError to try the plaintext scheme only be a good idea? This would reduce the possibility of a clash to the case of a plaintext password that is a valid a bcrypt hash. It does not sound like a good idea from a security perspective.
Should I consider this a non-issue if I make sure that all my users are not using a password that clashes with the bcrypt prefix? Or is it something that should be fixed in the library itself?
This probably affects other hash handlers.