38 lines
1.1 KiB
Plaintext
38 lines
1.1 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Noncompliant Code Example
|
|
|
|
----
|
|
function createMyAccount() {
|
|
$email = $_GET['email'];
|
|
$name = $_GET['name'];
|
|
$password = $_GET['password'];
|
|
|
|
$hash = hash_pbkdf2('sha256', $password, $email, 100000); // Noncompliant; salt (3rd argument) is predictable because initialized with the provided $email
|
|
|
|
$hash = hash_pbkdf2('sha256', $password, '', 100000); // Noncompliant; salt is empty
|
|
|
|
$hash = hash_pbkdf2('sha256', $password, 'D8VxSmTZt2E2YV454mkqAY5e', 100000); // Noncompliant; salt is hardcoded
|
|
|
|
$hash = crypt($password); // Noncompliant; salt is not provided; fails in PHP 8
|
|
$hash = crypt($password, ""); // Noncompliant; salt is hardcoded; fails in PHP 8
|
|
|
|
$options = [
|
|
'cost' => 11,
|
|
'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM), // Noncompliant ; use salt generated by default
|
|
];
|
|
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
----
|
|
$salt = openssl_random_pseudo_bytes(16);
|
|
$hash = hash_pbkdf2("sha256", $password, $salt, $iterations, 20);
|
|
----
|
|
|
|
include::../see.adoc[]
|