Skip to content

Conversation

@besser82
Copy link
Contributor

@besser82 besser82 commented Feb 16, 2018

The return values of crypt() and crypt_gensalt() should be treated as real c-strings instead of binary data by the module.

@besser82
Copy link
Contributor Author

The failing tests are not releated to this change.

@jdoss
Copy link

jdoss commented Apr 5, 2018

Any ETA on getting this merged? Bcrypt on with ruby-2.5.0-90.fc28.x86_64 on Fedora 28 Beta when using https://github.com/codahale/bcrypt-ruby/blob/master/lib/bcrypt/password.rb#L46 puts a bunch of null bytes on the end of the output.

We pointed our Gemfile at https://github.com/besser82/bcrypt-ruby/tree/libxcrypt and it totally fixes the problem.

Copy link
Collaborator

@tenderlove tenderlove left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR looks good, but I'm curious which change was actually necessary to fix the bug. Seems like only the second change is necessary (and maybe we should just change it to rb_str_new2).

if(!salt) return Qnil;

str_salt = rb_str_new2(salt);
str_salt = rb_str_new(salt, strlen(salt));
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this actually necessary to fix the bug? It seems like rb_str_new2 already does that. (rb_str_new2 is just an alias for rb_str_new_cstr)

@besser82
Copy link
Contributor Author

I've updated the PR.

@ojab
Copy link

ojab commented May 1, 2018

JFYI: Fedora-28 with libxcrypt is released.

@duritong
Copy link

duritong commented May 3, 2018

Fedora 28 was release 2 days ago and at the moment you can't use bcrypt on it. Can we get that fixed? Thanks!

@voxik
Copy link

voxik commented May 3, 2018

@duritong dnf install rubygem-bcrypt should do the job.

@ojab
Copy link

ojab commented May 3, 2018

Unfortunately it's not a solution for rvm/rbenv/etc-based workflow.

* master:
  Use RBX 3
  Try updating Bundler too
  Test on more Rubies in CI; looser version definition
  Update RG and see if that fixes the build
  Update lockfile so newer Ruby works with JSON gem
@tenderlove tenderlove merged commit 5c2d2d3 into bcrypt-ruby:master May 11, 2018
@tjschuck tjschuck mentioned this pull request May 15, 2018
@tjschuck
Copy link
Collaborator

I have just pushed version 3.1.12.rc1 to RubyGems.org which should solve this problem.

Can someone please confirm that gem install bcrypt --prerelease now works on Fedora 28? If so, I'll push out the final version.

@ojab
Copy link

ojab commented May 15, 2018

Works fine here (F28 w/ all updates, ruby-2.5.0p0 via rvm), thanks.

@patchkord
Copy link

Yes, now everything is ok on F28

@besser82 besser82 deleted the libxcrypt branch May 17, 2018 16:37
@miry
Copy link

miry commented Sep 21, 2019

Thanks. It fixes issue with

Sorcery::CryptoProviders::BCrypt.encrypt "Welcome2019", "ffLLizQt4eF_Dpd5mwcc"

raw_hash contains a huge binary string (sometime to other variables). It looks like size was calculated wrong for Fedora 30.

brianyee0 pushed a commit to silcam/cmbpayroll that referenced this pull request Oct 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants