Fail DecodeHash on \r or \n in base64 data

Return ErrInvalidHash on any.
alexedwards · Nov 13, 2023 · 587f314 · 587f314
1 parent ef1a6e0
commit 587f314
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/argon2id.go b/argon2id.go
@@ -177,6 +177,9 @@ func DecodeHash(hash string) (params *Params, salt, key []byte, err error) {
 	if err != nil {
 		return nil, nil, nil, err
 	}
+	if bytes.ContainsAny(rest, "\r\n") { // base64 decoder ignores these
+		return nil, nil, nil, ErrInvalidHash
+	}
 
 	var i int
 	if i = bytes.IndexByte(rest, '$'); i == -1 {

diff --git a/argon2id_test.go b/argon2id_test.go
@@ -83,6 +83,12 @@ func TestDecodeHash(t *testing.T) {
 			t.Fatalf("trailing %s value junk should fail decode", c)
 		}
 	}
+
+	i := strings.LastIndex(bugHash, "$")
+	_, _, _, err = DecodeHash(bugHash[:i] + "\r$\n" + bugHash[i+1:])
+	if err == nil {
+		t.Fatalf(`\r and \n in base64 data should fail decode`)
+	}
 }
 
 func TestCheckHash(t *testing.T) {