yyqdbngt opened a new pull request, #2401: URL: https://github.com/apache/rocketmq-dashboard/pull/2401
## Summary - validate encoded PBKDF2 salt and digest lengths before Base64 decoding - require the decoded salt and digest to match the format generated by the hasher - reject oversized or truncated stored hash fields without deriving a key ## Why Iteration counts are bounded, but corrupted database values can still contain arbitrarily large Base64 fields. Decoding those fields allocates memory before the password check can reject them. ## Tests - `mvn -q -f server/pom.xml -Dtest=PasswordHasherTest test` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
