Skip to content

Commit 0e6096e

Browse files
committed
fix(isHashMatch): check that hash starts with $
Previously, we used argon2 to verify the hash with the password. If the hash didn't start with a $, then it would enter the catch block. Now we check the hash before trying to verify it and we also throw an Error if the verify fails. This makes the isHashMatch function more robust.
1 parent e9d4f87 commit 0e6096e

File tree

2 files changed

+8
-3
lines changed

2 files changed

+8
-3
lines changed

src/node/util.ts

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -166,14 +166,13 @@ export const hash = async (password: string): Promise<string> => {
166166
* Used to verify if the password matches the hash
167167
*/
168168
export const isHashMatch = async (password: string, hash: string) => {
169-
if (password === "" || hash === "") {
169+
if (password === "" || hash === "" || !hash.startsWith("$")) {
170170
return false
171171
}
172172
try {
173173
return await argon2.verify(hash, password)
174174
} catch (error) {
175-
logger.error(error)
176-
return false
175+
throw new Error(error)
177176
}
178177
}
179178

test/unit/node/util.test.ts

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,12 @@ describe("isHashMatch", () => {
189189
const actual = await util.isHashMatch(password, _hash)
190190
expect(actual).toBe(false)
191191
})
192+
it("should return false and not throw an error if the hash doesn't start with a $", async () => {
193+
const password = "hellowpasssword"
194+
const _hash = "n2i$v=19$m=4096,t=3,p=1$EAoczTxVki21JDfIZpTUxg$rkXgyrW4RDGoDYrxBFD4H2DlSMEhP4h+Api1hXnGnFY"
195+
expect(() => util.isHashMatch(password, _hash)).not.toThrow()
196+
expect(await util.isHashMatch(password, _hash)).toBe(false)
197+
})
192198
})
193199

194200
describe("hashLegacy", () => {

0 commit comments

Comments
 (0)