[php-src] PR #24302: GH-24203 follow-up: Stricter bcrypt hash format validation
| From: | narfbg | Date: | Tue, 13 Oct 2026 18:10:10 +0000 |
| Subject: | [php-src] PR #24302: GH-24203 follow-up: Stricter bcrypt hash format validation | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39390@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24302
Author: narfbg
Back to
sscanf() usage, but with ironclad sanity checks and
php_password_bcrypt_parse() can be used more explicitly as a validator, without
attempting to extract cost for the caller.
Implements what I meant with https://github.com/php/php-src/pull/24203#issuecomment-6148419207,
somewhat with intent to also move this exception inside php_password_bcrypt_get_cost(),
but it's a breaking change:
https://github.com/php/php-src/blob/3c1a0727162784b89d78eb494185444d75917e95/ext/standard/password.c#L203-L206