From 1a5c41871cc2444faef0fdde115b8988b71c4c23 Mon Sep 17 00:00:00 2001 From: reverse Date: Wed, 19 Aug 2026 04:45:07 +0000 Subject: [PATCH] =?UTF-8?q?password=5Fhash:=20reject=20an=20empty=20PBKDF2?= =?UTF-8?q?=20hash/salt=20=E2=80=94=20a=20stored=20'pbkdf2:iters:salt:'=20?= =?UTF-8?q?(empty=20hash)=20made=20ct=5Feq(&[],&[])=20return=20true,=20ver?= =?UTF-8?q?ifying=20ANY=20password;=20refuse=20empty=20want/salt=20before?= =?UTF-8?q?=20computing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/modules/password_hash.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/modules/password_hash.rs b/src/modules/password_hash.rs index bff9deb..7f75f89 100644 --- a/src/modules/password_hash.rs +++ b/src/modules/password_hash.rs @@ -94,6 +94,9 @@ pub fn verify(stored: &str, plaintext: &str) -> bool { if !(1..=MAX_PBKDF2_ITERS).contains(&iters) { return false; // absurd/zero work factor — refuse, don't compute } + if want.is_empty() || salt.is_empty() { + return false; // an empty hash/salt would make ct_eq(&[],&[]) accept any password + } if let Some(got) = pbkdf2(plaintext, &salt, iters, want.len()) { return ct_eq(&got, &want); }