Browse Source

fix check bug

Looly 4 years ago
parent
commit
221608b544

+ 1 - 0
CHANGELOG.md

@@ -21,6 +21,7 @@
 * 【core   】     修复Console.input读取不全问题(pr#263@Gitee)
 * 【core   】     修复URLUtil.encodeAll未检查空指针问题(issue#I2CNPS@Gitee)
 * 【core   】     修复UrlBuilder.of的query中含有?丢失问题(issue#I2CNPS@Gitee)
+* 【crypto 】     修复BCrypt.checkpw报错问题(issue#1377@Github)
 
 -------------------------------------------------------------------------------------------------------------
 

+ 8 - 1
hutool-crypto/src/main/java/cn/hutool/crypto/digest/BCrypt.java

@@ -511,7 +511,14 @@ public class BCrypt {
 	public static boolean checkpw(String plaintext, String hashed) {
 		byte[] hashed_bytes;
 		byte[] try_bytes;
-		String try_pw = hashpw(plaintext, hashed);
+
+		String try_pw;
+		try{
+			try_pw = hashpw(plaintext, hashed);
+		} catch (Exception ignore){
+			// 生成密文时错误直接返回false issue#1377@Github
+			return false;
+		}
 		hashed_bytes = hashed.getBytes(CharsetUtil.CHARSET_UTF_8);
 		try_bytes = try_pw.getBytes(CharsetUtil.CHARSET_UTF_8);
 		if (hashed_bytes.length != try_bytes.length) {

+ 14 - 0
hutool-crypto/src/test/java/cn/hutool/crypto/test/digest/BCryptTest.java

@@ -0,0 +1,14 @@
+package cn.hutool.crypto.test.digest;
+
+import cn.hutool.crypto.digest.BCrypt;
+import org.junit.Assert;
+import org.junit.Test;
+
+public class BCryptTest {
+
+	@Test
+	public void checkpwTest(){
+		Assert.assertFalse(BCrypt.checkpw("xxx",
+				"$2a$2a$10$e4lBTlZ019KhuAFyqAlgB.Jxc6cM66GwkSR/5/xXNQuHUItPLyhzy"));
+	}
+}