Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
passlib
passlib
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 30
    • Issues 30
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 0
    • Merge Requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Operations
    • Operations
    • Incidents
    • Environments
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • CI/CD
    • Repository
    • Value Stream
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Members
    • Members
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • python-libs
  • passlibpasslib
  • Issues
  • #78

Closed
Open
Created Nov 15, 2016 by Bitbucket Importer@bitbucket_importerOwner

Using bcrypt and plaintext schemes together may cause a ValueError exception

Created originally on Bitbucket by Anonymous

If the plaintext password happens to start with the prefix that identifies bcrypt, it fails with a ValueError. This snippet reproduces the issue:

#!python

from passlib.context import CryptContext

passlib_ctx = CryptContext(schemes=[
        "bcrypt",
        "plaintext",
])

plaintext = 'potato'
hashed = passlib_ctx.encrypt(plaintext)
#problematic_plaintext = '$2a$12$D2ZnWsBaBEJzWxmYK3.A'
#problematic_plaintext = '$2a$12$D7Q0W92sodO2FsqcBYAnnuueFC6bqg1abhMBKfJNGw4l4A0BsR'
#problematic_plaintext = '$2a$12$D'
#problematic_plaintext = '$2a$12'  
problematic_plaintext = '$2a$'

assert passlib_ctx.verify(plaintext, plaintext)
assert passlib_ctx.verify(plaintext, hashed)
assert passlib_ctx.verify(problematic_plaintext, problematic_plaintext)

I'm not sure how that could be solved. Would catching the ValueError to try the plaintext scheme only be a good idea? This would reduce the possibility of a clash to the case of a plaintext password that is a valid a bcrypt hash. It does not sound like a good idea from a security perspective.

Should I consider this a non-issue if I make sure that all my users are not using a password that clashes with the bcrypt prefix? Or is it something that should be fixed in the library itself?

This probably affects other hash handlers.

Assignee
Assign to
2.0
Milestone
2.0
Assign milestone
Time tracking
None
Due date
None