Update for BCrypt wrap bug detected

[mo7ty]

• Refer to BCrypt wrap bug detected #18

[notypecheck]

Hey, thanks for the PR! Do you have time to finish it (since you've set it as "draft") or can I pick it up from there?

[mo7ty]

Hi @notypecheck!
I intend to complete this PR still today, with the missing test_handlers_bcrypt.py update.
Is there anything that also needs to be considered?

[notypecheck]

No, not really, I'll just fix formatting and other things that linters may complain about, but you don't have to worry about that

[mo7ty]

Hi @notypecheck!
I've updated the PR, but was unable to update it for the following tests:

• <tests.test_handlers_bcrypt.bcrypt_bcrypt_test testMethod=test_secret_w_truncate_size>
• <tests.test_handlers_django.django_bcrypt_test testMethod=test_secret_w_truncate_size>

Can you please help here?

[notypecheck]

I think for now it would be better to release a new version, pinning bcrypt to <5.0.0 (so people don't experience that bug, at least when installing the latest version), and then decide if it's worth keeping the old behavior, or using already existing TruncateMixin, which should raise an error in case the given password/secret exceeds 72 characters.

[mgorny]

Wouldn't it be simpler to just skip the check when using new enough bcrypt?

[notypecheck]

@mgorny I think majority of the existing checks can be disabled, passlib at the time supported multiple bcrypt implementations (like py-bcrypt), and I don't think we need anything besides the bcrypt one nowadays.

[mo7ty]

Hi @notypecheck and @mgorny,
IMHO it makes all sense to only accept the bcrypt implementation nowadays, and also stop accounting for old behaviours (like the $2a wrap bug) in favour of possibly starting to use TruncateMixin along with passlib.exc.PasswordTruncateError.
Happy to leave this PR open and try to start that update here, where everyone's contribution and help are welcome.

[mo7ty]

Moved to PR Update for BCrypt wrap bug detected #24.