Merge pull request #3698 from cdr/jsjoeio-fix-argon-issue

jsjoeio · web-flow · commit faa896c12c7d · 2021-07-01T10:33:29.000-07:00
fix(isHashMatch): check that hash starts with $
diff --git a/src/node/util.ts b/src/node/util.ts
@@ -166,14 +166,13 @@ export const hash = async (password: string): Promise<string> => {
  * Used to verify if the password matches the hash
  */
 export const isHashMatch = async (password: string, hash: string) => {
-  if (password === "" || hash === "") {
+  if (password === "" || hash === "" || !hash.startsWith("$")) {
     return false
   }
   try {
     return await argon2.verify(hash, password)
   } catch (error) {
-    logger.error(error)
-    return false
+    throw new Error(error)
   }
 }
 
diff --git a/test/unit/node/util.test.ts b/test/unit/node/util.test.ts
@@ -189,6 +189,17 @@ describe("isHashMatch", () => {
     const actual = await util.isHashMatch(password, _hash)
     expect(actual).toBe(false)
   })
+  it("should return false and not throw an error if the hash doesn't start with a $", async () => {
+    const password = "hellowpasssword"
+    const _hash = "n2i$v=19$m=4096,t=3,p=1$EAoczTxVki21JDfIZpTUxg$rkXgyrW4RDGoDYrxBFD4H2DlSMEhP4h+Api1hXnGnFY"
+    expect(async () => await util.isHashMatch(password, _hash)).not.toThrow()
+    expect(await util.isHashMatch(password, _hash)).toBe(false)
+  })
+  it("should reject the promise and throw if error", async () => {
+    const password = "hellowpasssword"
+    const _hash = "$ar2i"
+    expect(async () => await util.isHashMatch(password, _hash)).rejects.toThrow()
+  })
 })
 
 describe("hashLegacy", () => {

Original file line number	Diff line number	Diff line change
`@@ -166,14 +166,13 @@ export const hash = async (password: string): Promise<string> => {`
`166`	`166`	`* Used to verify if the password matches the hash`
`167`	`167`	`*/`
`168`	`168`	`export const isHashMatch = async (password: string, hash: string) => {`
`169`		`- if (password === "" \|\| hash === "") {`
	`169`	`+ if (password === "" \|\| hash === "" \|\| !hash.startsWith("$")) {`
`170`	`170`	`return false`
`171`	`171`	`}`
`172`	`172`	`try {`
`173`	`173`	`return await argon2.verify(hash, password)`
`174`	`174`	`} catch (error) {`
`175`		`- logger.error(error)`
`176`		`- return false`
	`175`	`+ throw new Error(error)`
`177`	`176`	`}`
`178`	`177`	`}`
`179`	`178`