[php-src] Issue #8397: crypt() accepts invalid characters in salt
| From: | cmb69 | Date: | Thu, 21 Apr 2022 13:02:46 +0000 |
| Subject: | [php-src] Issue #8397: crypt() accepts invalid characters in salt | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-241121@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8397
Comment Author: cmb69
> From a user perspective, if I install Ubuntu's
> [php7.4](https://packages.ubuntu.com/focal/php7.4) package, there's no way to tell which
> version of crypt() is being used or has been linked against at built-time.
It might be reasonable to expose this information somehow; maybe a constant
(
PHP_CRYPT_IMPL) or some entry in phpinfo().
> Besides, the *0 return to mark an error doesn't seem well documented anywhere and has been
> pretty unexpected to me.
The
[documentation](https://www.php.net/manual/en/function.crypt.php#refsect1-function.crypt-returnvalues)
states:
> Returns the hashed string or a string that is shorter than 13 characters and is guaranteed to
> differ from the salt on failure.
Since strlen("*0") < 13, this is covered by the documentation.