radiac / mara / 24

77%

Pull #3

travis-ci

strip NUL characters where it actually matters

bcrypt doesn't handle NUL characters. Probably with that in mind,
mara strips any NUL char from the string that is going to be hashed.
However, the strip is taking place before sha512'ing the password,
and sha512 *can* produce NUL chars.

This patch moves the stripping of NUL characters to the already sha512
hashed string, thus ensuring that no NUL character reaches the bcrypt
hashing function itself.

Note: since this actually changes the hashed password, this change
might not be backwards compatible with your current database.

1 of 1 new or added line in 1 file covered. (100.0%)

2457 of 3175 relevant lines covered (77.39%)

3.08 hits per line