Update to jBCrypt 0.3 to fix security vulnerability (http://www.mindrot.org/projects/jBCrypt/news/rel03.html)

tmm1 · tmm1 · commit 92c8e4e3760d · 2011-01-08T14:39:03.000-08:00
diff --git a/ext/jruby/bcrypt_jruby/BCrypt.java b/ext/jruby/bcrypt_jruby/BCrypt.java
@@ -63,7 +63,7 @@
  */
 public class BCrypt {
 	// BCrypt parameters
-	private static int GENSALT_DEFAULT_LOG2_ROUNDS = 10;
+	private static final int GENSALT_DEFAULT_LOG2_ROUNDS = 10;
 	private static final int BCRYPT_SALT_LEN = 16;
 
 	// Blowfish parameters
@@ -655,13 +655,14 @@ public static String hashpw(String password, String salt) {
 
 		if (salt.charAt(0) != '$' || salt.charAt(1) != '2')
 			throw new IllegalArgumentException ("Invalid salt version");
-		if (salt.charAt(1) != '$') {
+		if (salt.charAt(2) == '$')
+			off = 3;
+		else {
 			minor = salt.charAt(2);
 			if (minor != 'a' || salt.charAt(3) != '$')
 				throw new IllegalArgumentException ("Invalid salt revision");
 			off = 4;
-		} else
-			off = 3;
+		}
 
 		// Extract number of rounds
 		if (salt.charAt(off + 2) > '$')
@@ -670,10 +671,9 @@ public static String hashpw(String password, String salt) {
 
 		real_salt = salt.substring(off + 3, off + 25);
 		try {
-			passwordb = (password + (minor >= 'a' ? "\000" : "")).getBytes("US-ASCII");
+			passwordb = (password + (minor >= 'a' ? "\000" : "")).getBytes("UTF-8");
 		} catch (UnsupportedEncodingException uee) {
-			// The JDK guarantees that US-ASCII is supported.
-			throw new AssertionError("US-ASCII is not supported");
+			throw new AssertionError("UTF-8 is not supported");
 		}
 
 		saltb = decode_base64(real_salt, BCRYPT_SALT_LEN);
diff --git a/spec/TestBCrypt.java b/spec/TestBCrypt.java
@@ -172,4 +172,23 @@ public void testCheckpw_failure() {
 		}
 		System.out.println("");
 	}
+
+	/**
+	 * Test for correct hashing of non-US-ASCII passwords
+	 */
+	public void testInternationalChars() {
+		System.out.print("BCrypt.hashpw w/ international chars: ");
+		String pw1 = "ππππππππ";
+		String pw2 = "????????";
+
+		String h1 = BCrypt.hashpw(pw1, BCrypt.gensalt());
+		assertFalse(BCrypt.checkpw(pw2, h1));
+		System.out.print(".");
+
+		String h2 = BCrypt.hashpw(pw2, BCrypt.gensalt());
+		assertFalse(BCrypt.checkpw(pw1, h2));
+		System.out.print(".");
+		System.out.println("");
+	}
+
 }
