efegokdemir opened a new pull request, #445: URL: https://github.com/apache/commons-codec/pull/445
## Description `Sha2Crypt` accepted malformed salt strings such as `$5$notrounds=1000$asdfasdf` and salts containing characters outside the documented alphabet by matching a valid prefix and ignoring the remaining input. The validation pattern is now anchored to the complete salt structure while preserving the existing support for an optional hash suffix and salt truncation. ## Link to tracking issue https://issues.apache.org/jira/browse/CODEC-245 ## Testing - `mvn -Dtest=Sha512CryptTest test` - `mvn test` - `mvn -DskipTests verify` - `git diff --check` All commands completed successfully. The pre-fix regression run failed because the malformed inputs were accepted; the focused test passes with this change. ## Documentation No documentation changes are required. Existing valid salts, including salts followed by a hash suffix and salts longer than 16 characters, remain covered by the existing tests. ## AI disclosure - [x] I used AI to create part of this pull request. Codex assisted with issue investigation, implementation, test authoring, and validation; I reviewed the resulting changes and test output. The open `CODEC-182` PR #301 concerns separate Javadoc/prefix validation changes and does not implement the malformed-rounds or invalid-character rejection tracked by CODEC-245. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
