Maximum password length should be exposed to userland when libxcrypt is used
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
When PHP is built against an external libxcrypt (--with-external-libcrypt, e.g. on Fedora and derivatives), passwords passed to crypt are limited by CRYPT_MAX_PASSPHRASE_SIZE which is by default 512. However, there's no way for userland to determine whether such a limit is in force, which can cause confusion. For example, the following code:
<?php
var_dump(crypt(str_repeat("a",513),"\$2y\$05\$" . str_repeat("b",22)));
Results in this output:
string(2) "*0"
I think it would be useful to expose this limit as a constant or helper function so that applications can determine whether crypt() password sizes are limited.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reported crypt() call and the --with-external-libcrypt build path, reproducing the 513-character example on a libxcrypt build. Done means PHP userland has a way to determine the active password-length limit; the exact constant or helper remains to be designed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, php
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100