[php-src] Issue #8397: crypt() accepts invalid characters in salt
| From: | nikic | Date: | Sat, 30 Apr 2022 09:24:46 +0000 |
| Subject: | [php-src] Issue #8397: crypt() accepts invalid characters in salt | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-241348@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8397
Comment Author: nikic
As to the original issue, I'm not sure there's much we can do here -- the validation here
is clearly a moving target for the system implementation, so if we adopted the stricter validation
seen on Ubuntu 20.04 we would not fail to process hashes from Ubuntu 18.04. I think the only viable
option here is to recommend users who care about interoperability with system crypt to build with
--with-external-libcrypt, in which case we'd want to reclassify this as a
documentation issue.