Repository navigation
BCrypt::Engine.hash_secret method is generating unexpected long hash string on Fedora 28 #165
Description
I tried to generate a new password with Password.create('test') but it throws BCrypt::Errors::InvalidHash (invalid hash) error. Then i try to generate hash with BCrypt::Engine.hash_secret('secret', BCrypt::Engine.generate_salt(1)) to see what's wrong there and i noticed the code generated 32767 character long string as the following
$2a$04$tk0ZskJEMxKW5Zx0OIMy/Ot5z.Vleg7SXfRV9.GryPpKRchRK/S3m\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\............
Because of unexpected long hash string the valid_hash? method returns nil and broke the app.
I test the problem against to ruby 2.4.1, 2.5.0 and 2.5.1 on Fedora 28. All of them were failing.
I check the GCC version and noticed that it upgraded to 8.x on Fedora 28. I am not sure, but it could be a compiler related bug..
Activity
ai commentedon Apr 22, 2018
@tjschuck I confirm this issue in our Rails app
I fixed it just with:
ai commentedon Apr 22, 2018
@tjschuck Seems like this PR could fix the problem #164
tjschuck commentedon May 15, 2018
I have just pushed version 3.1.12.rc1 to RubyGems.org which should solve this problem.
Can someone please confirm that
gem install bcrypt --prereleasenow works on Fedora 28? If so, I'll push out the final version.Xenosb commentedon May 16, 2018
Hi,
i have tested with my application. It failed on 3.1.11 while it works perfectly on 3.1.12.rc1
Using ruby 2.5.1 and rails 5.1.5 on Fedora 28
tjschuck commentedon May 16, 2018
Version 3.1.12 of the bcrypt gem, which should fix this issue, was just pushed to RubyGems.
You should now be able to
gem install bcrypton Fedora with none of the above workarounds.Thanks, everyone!
m13m commentedon Aug 10, 2018
@tjschuck I am still getting the issue
BCrypt::Errors::InvalidHash: invalid hashOS : Fedora 28
Rails: 5.1.6
Ruby: 2.5.1p57 (2018-03-29 revision 63029) [x86_64-linux]
Newer bcrypt gem needed for Fedora 28
bundle: upgrade bcrypt
bundle: upgrade bcrypt
bundle: upgrade bcrypt