[Django] #31719: Remaining data.decode('ascii') @ hashers.py, but data is a str
Django
-------------------------------------+-------------------------------------
Reporter: Marcel | Owner: nobody
Nogueira d' Eurydice |
Type: Bug | Status: new
Component: | Version: 3.0
contrib.auth | Keywords: string, decode,
Severity: Normal | python3
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
BCryptSHA256PasswordHasher class method enconde tries to decode data, but
data is a str. In Python3 a str instance does not have a decode method.
{{{
def encode(self, password, salt):
bcrypt = self._load_library()
password = password.encode()
# Hash the password prior to using bcrypt to prevent password
# truncation as described in #20138.
if self.digest is not None:
# Use binascii.hexlify() because a hex encoded bytestring is
str.
password = binascii.hexlify(self.digest(password).digest())
data = bcrypt.hashpw(password, salt)
return "%s$%s" % (self.algorithm, data.decode('ascii'))
}}}
the return statement should be
{{{
return "%s$%s" % (self.algorithm, data)
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/31719>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
-------------------------------------+-------------------------------------
Eurydice |
Type: Bug | Status: closed
Component: contrib.auth | Version: 3.0
Severity: Normal | Resolution: invalid
Keywords: string, decode, | Triage Stage:
python3 | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
* status: new => closed
* resolution: => invalid
Comment:
`bcrypt.hashpw` returns `bytes` (and not `str`) which do have a `.decode`
method and it's usage is necessary for the string interpolation into
`"%s$%s"` to work properly.
{{{#!python
>>> import bcrypt
>>> type(bcrypt.hashpw(b'password', bcrypt.gensalt()))
bytes
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/31719#comment:1>
Django
-------------------------------------+-------------------------------------
Eurydice |
Type: Bug | Status: closed
Component: contrib.auth | Version: 3.0
Severity: Normal | Resolution: invalid
Keywords: string, decode, | Triage Stage:
python3 | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by naohide):
I'm facing the same issue. And tried to check type but I got str.. I don't
know why though..
```
import bcrypt
type(bcrypt.hashpw(b'password', bcrypt.gensalt()))
<class 'str'>
```
--
Ticket URL: <https://code.djangoproject.com/ticket/31719#comment:2>
Django
-------------------------------------+-------------------------------------
Eurydice |
Type: Bug | Status: closed
Component: contrib.auth | Version: 3.0
Severity: Normal | Resolution: invalid
Keywords: string, decode, | Triage Stage:
python3 | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by felixxm):
naohide, probably because you're using Python 2 which is not supported.
--
Ticket URL: <https://code.djangoproject.com/ticket/31719#comment:3>
Django
-------------------------------------+-------------------------------------
Eurydice |
Type: Bug | Status: closed
Component: contrib.auth | Version: 3.0
Severity: Normal | Resolution: invalid
Keywords: string, decode, | Triage Stage:
python3 | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by naohide):
Replying to [comment:3 felixxm]:
> naohide, probably because you're using Python 2 which is not supported.
I'm using Python3.8.5.
--
Ticket URL: <https://code.djangoproject.com/ticket/31719#comment:4>
Django
-------------------------------------+-------------------------------------
Eurydice |
Type: Bug | Status: closed
Component: contrib.auth | Version: 3.0
Severity: Normal | Resolution: invalid
Keywords: string, decode, | Triage Stage:
python3 | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by naohide):
I checked _bcrypt.py and this might be the reason. I'm using
https://pypi.org/project/py-bcrypt/ and called this package's bcrypt.
'''
# encoding: utf-8
# module bcrypt._bcrypt
# from /.virtualenvs/project/lib/python3.8/site-
packages/bcrypt/_bcrypt.cpython-38-darwin.so
# by generator 1.145
""" Internal module used by bcrypt. """
'''
--
Ticket URL: <https://code.djangoproject.com/ticket/31719#comment:5>
Django
-------------------------------------+-------------------------------------
Eurydice |
Type: Bug | Status: closed
Component: contrib.auth | Version: 3.0
Severity: Normal | Resolution: invalid
Keywords: string, decode, | Triage Stage:
python3 | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by naohide):
Replying to [comment:5 naohide]:
> I checked _bcrypt.py and this might be the reason. I'm using
https://pypi.org/project/py-bcrypt/ and called this package's bcrypt.
>
> What do you guys use normally?
>
> '''
> # encoding: utf-8
> # module bcrypt._bcrypt
> # from /.virtualenvs/project/lib/python3.8/site-
packages/bcrypt/_bcrypt.cpython-38-darwin.so
> # by generator 1.145
> """ Internal module used by bcrypt. """
> '''
got it. I changed py-bcrypt to https://pypi.org/project/bcrypt/ and worked
fine for me!
--
Ticket URL: <https://code.djangoproject.com/ticket/31719#comment:6>