Better password hashes error handling (thomiceli#132)

jiriks74 · Oct 13, 2023 · b1acea9 · b1acea9
1 parent 7059d5c
commit b1acea9
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/internal/web/util.go b/internal/web/util.go
@@ -265,8 +265,16 @@ func (a Argon2ID) hash(plain string) (string, error) {
 }
 
 func (a Argon2ID) verify(plain, hash string) (bool, error) {
+ if hash == "" {
+ return false, nil
+ }
+
  hashParts := strings.Split(hash, "$")
 
+ if len(hashParts) != 6 {
+ return false, errors.New("invalid hash")
+ }
+
  _, err := fmt.Sscanf(hashParts[3], "m=%d,t=%d,p=%d", &a.memory, &a.time, &a.threads)
  if err != nil {
  return false, err