Repository navigation
feat(security): pure-CFML bcrypt hash/verify helpers - #3455
Merged
Merged
Conversation
Signed-off-by: Peter Amiri <peter@alurium.com>
RustCFML ships bcryptHash/bcryptVerify as native builtins, so defining
the pure-CFML copies in security.cfm collides at boot ("The name
[bcryptHash] is already used by a built in Function").
Global.cfc now skips the security.cfm include when getFunctionList()
already provides bcryptHash, and always includes the new standalone
security-extra.cfm — bcryptNeedsRehash plus its cost validation have no
engine builtin and ship on every engine.
BcryptSpec skips the pure-CFML-specific pins (the $2b$ prefix and the
Wheels.InvalidArgument cost errors) when the native builtins are in use,
and bcryptNeedsRehash normalizes the parsed cost with Val() so
RustCFML's non-coercing string/number comparison still sees 04 == 4.
Signed-off-by: Peter Amiri <peter@alurium.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The final 4.x-backlog item: pure-CFML bcrypt password helpers (#9).
vendor/wheels/global/security.cfm—bcryptHash(password, cost=10)/bcryptVerify(password, hash)/bcryptNeedsRehash(hash, cost=10), standard$2b$60-char hashes compatible with OpenBSDhtpasswdand jBCrypt (verified byte-for-byte against htpasswd output and the official jBCrypt test vectors — including the$2a$"abc" vector). No Java objects/CFX: runs on Lucee, Adobe, BoxLang, and RustCFML.vendor/wheels/Global.cfc— security.cfm include ladder (same pattern as the other global files).vendor/wheels/tests/specs/security/BcryptSpec.cfc— 12 specs: external-vector verify (true / wrong-password / tampered), jBCrypt reference vector, cost-4 round-trip, 60-char$2b$format, cost bounds (3/32 throwWheels.InvalidArgument), verify-never-throws on 7 malformed inputs, unicode round-trip, needsRehash, fresh salt per call.bcryptHash()/bcryptVerify()(60-char column).changelog.d/bcrypt-pure-cfml.added.md.Honest performance note
Pure-CFML bcrypt is inherently slow: ~230 ms at cost 4, ~14 s at cost 10 on Lucee (~170M bit operations; CFML bit-ops are ~60–80 ns each vs native Java's ~100 ms for the same rounds). Correctness and format compatibility are the gate here — cost 10 remains fine for auth events (login/signup), but callers doing bulk hashing should use a lower cost or a native library. Documented in the spec and the changelog fragment.
Verification