Ruby 2.2.0 + bcrypt + ActiveRecord + YAML → BCrypt::Errors::InvalidSalt #106

Activity

1. recurser commented on Jan 8, 2015

   

   recurser

   on Jan 8, 2015

   More actions

   👍
2. be9 commented on Jan 8, 2015

   

   be9

   on Jan 8, 2015

   Author

   More actions

   Updated the gist with even more minimal test: https://gist.github.com/be9/c549ff6469d5627aa900#file-minitest-rb

   require 'rubygems'
   require 'bundler/setup'
   require 'bcrypt'
   require 'psych'
   
   # This raises BCrypt::Errors::InvalidSalt under Ruby 2.2.0 and bcrypt 3.1.9
   BCrypt::Password.create("my password").to_yaml
3. mattwildig

   added a commit that references this issue on Jan 9, 2015

   Make version attribute a plain String

   ...

   This issue will close once commit f1621d6 is merged into the 'master' branch.

   f1621d6
4. ugoa commented on Jan 13, 2015

   

   ugoa

   on Jan 13, 2015

   More actions

   👍
5. svoop commented on Jan 23, 2015

   

   svoop

   on Jan 23, 2015

   More actions

   Thanks for the fix, @mattwildig, hope it will be adopted and published soon. (With omniauth-identity, this issue causes quite some headache, at least I couldn't bundle the fixed version from mattwildig/bcrypt-ruby and had to manually patch the line in the deployed gem.)
6. jmccartie commented on Jan 24, 2015

   

   jmccartie

   on Jan 24, 2015

   More actions

   👍
7. rmarescu commented on Jan 28, 2015

   

   rmarescu

   on Jan 28, 2015

   More actions

   👍

   A bit of a blocker for anybody who uses bcrypt and wants to upgrade to Ruby 2.2.0
8. tjschuck

   closed this as completedin f1621d6on Jan 29, 2015
9. svoop commented on Jan 29, 2015

   

   svoop

   on Jan 29, 2015

   More actions

   Thanks a bunch, @tjschuck !
10. rmarescu commented on Jan 29, 2015

    

    rmarescu

    on Jan 29, 2015

    More actions

    Awesome, thanks!
11. zz9pzza

    added a commit that references this issue on Mar 3, 2015

    bcrypt is broken bcrypt-ruby/bcrypt-ruby#106

    c4772c7
12. yukas commented on Mar 31, 2016

    

    yukas

    on Mar 31, 2016

    More actions

    Hey, guys

    Although bug is already fixed in 3.1.10, problem still persists in Rails 3.2, because it is locked on bcrypt-ruby ~> 3.0.0.

    Can we release bcrypt-ruby 3.0.x with this bug fixed?

    I already made the fix here, but there is no bcrypt-ruby 3.0.x branch to make a PR :(

    Can someone help me with releasing 3.0.x version with this bug fixed?
13. yukas commented on Apr 1, 2016

    

    yukas

    on Apr 1, 2016

    More actions

    @tjschuck can you help me out here?
14. tjschuck commented on Apr 7, 2016

    

    tjschuck

    on Apr 7, 2016

    Collaborator

    More actions

    @yukas Rails 3.2 is no longer supported even for security updates, so you should either a.) upgrade to a more recent version of Rails, or b.) already be maintaining your own fork of 3.2 so that you can patch it with fixes like the one you mentioned.