Beispiel

Handle bcryptjs parameter asymmetries in hash salt defaults, selective 60-character error throwing in compare, fallback random precedence, and custom Base64 encoding

sha256:9e53fd13103b399494311358bf94c04682964ebb0f7c6cc08d8077e3ab99f3db

Fall

Ziel

Handle bcryptjs parameter asymmetries in hash salt defaults, selective 60-character error throwing in compare, fallback random precedence, and custom Base64 encoding HOW

Pakete

bcryptjs 3.0.3

Umgebung

node

Erstellt

2026-08-17T15:40:43Z

Häufige Annahme

bcrypt.compareSync returns boolean false for any non-matching password hash and hash defaults to 10 rounds when the salt parameter is omitted

So hat der Autor des Samples festgehalten, was eine Entwicklerin oder ein Modell hier erwarten würde. Der Vertrag darunter ist das, was tatsächlich lief.

Contract

• assert compareSync returns boolean false for mismatched hashes whose length is not 60, but throws an uncaught Error on 60-character invalid or unsupported revision strings, while async hash rejects with Illegal arguments unless rounds or salt is explicitly supplied
• assert hashSync defaults to 10 rounds producing a 60-character $2b$10$ hash when salt is omitted, whereas async hash without salt rejects with 'Illegal arguments: string, undefined'
• assert setRandomFallback does not override crypto.getRandomValues or node:crypto when available, only executing if native crypto is absent
• assert genSaltSync(0) evaluates 0 || 10 and produces 10 rounds, while rounds 1 to 3 are silently clamped to 4 and rounds above 31 are clamped to 31
• assert compareSync and async compare throw 'Invalid salt version' on 60-character non-bcrypt strings and 'Invalid salt revision' on $2x$, but return false on length mismatches
• assert $2a$, $2b$, and $2y$ 60-character hashes verify with compareSync, whereas legacy $2$ produces a 59-character hash that fails compareSync and causes getSalt to throw
• assert encodeBase64 and decodeBase64 use bcrypt's non-standard alphabet where index 0 is '.' rather than 'A', causing standard RFC 4648 Base64 'AAAA' to decode to [8, 32, 130]
• assert async functions return a Promise when callback is omitted, but return undefined when a callback is passed
• assert truncates measures UTF-8 byte length with boundary at 72 bytes across multibyte characters and surrogate pairs, causing passwords sharing their initial 72 bytes to collide under compareSync
• assert embedded null bytes in passwords are preserved during UTF-8 array conversion rather than terminating early, producing distinct hashes for 'secret' and 'secret\x00'
• assert getRounds returns NaN without throwing on empty or malformed strings, while getSalt strictly requires length 60 and extracts 29 characters without format validation
• assert bcryptjs 3 defines an exports map restricting subpaths so requiring 'bcryptjs/package.json' throws ERR_PACKAGE_PATH_NOT_EXPORTED

Dateien

• NOTES.md
• csx.json
• package-lock.json
• package.json
• src/index.mjs
• test/contract.mjs

Quellartefakt herunterladen (tar.gz)

Ursprungs-Seeder

csx-seed

Verifizierungsbelege

• node 22 · linux alpine/x64 · docker · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · node-typescript@1 · 2026-08-17 · ed25519:d91480838ac982c9