[12.x] Allow limiting bcrypt hashing to 72 bytes to prevent insecure hashes.

config/hashing.php

@@ -31,6 +31,7 @@
     'bcrypt' => [
         'rounds' => env('BCRYPT_ROUNDS', 12),
         'verify' => env('HASH_VERIFY', true),
+        'limit_length' => env('BCRYPT_LIMIT_LENGTH', true),
     ],
 
     /*

src/Illuminate/Hashing/BcryptHasher.php

@@ -8,6 +8,13 @@
 
 class BcryptHasher extends AbstractHasher implements HasherContract
 {
+    /**
+     * The maximum byte length of the value to hash.
+     *
+     * @var int
+     */
+    const MAX_BYTE_LENGTH = 72;
+
     /**
      * The default cost factor.
      *
@@ -22,6 +29,13 @@ class BcryptHasher extends AbstractHasher implements HasherContract
      */
     protected $verifyAlgorithm = false;
 
+    /**
+     * Impose bcrypt byte limit.
+     *
+     * @var bool
+     */
+    protected $limitLength = false;
+
     /**
      * Create a new hasher instance.
      *
@@ -32,6 +46,7 @@ public function __construct(array $options = [])
     {
         $this->rounds = $options['rounds'] ?? $this->rounds;
         $this->verifyAlgorithm = $options['verify'] ?? $this->verifyAlgorithm;
+        $this->limitLength = $options['limit_length'] ?? $this->limitLength;
     }
 
     /**
@@ -46,6 +61,10 @@ public function __construct(array $options = [])
     public function make(#[\SensitiveParameter] $value, array $options = [])
     {
         try {
+            if ($this->limitLength && strlen($value) > self::MAX_BYTE_LENGTH) {
+                throw new BcryptValueTooLongException;
+            }
+
             $hash = password_hash($value, PASSWORD_BCRYPT, [
                 'cost' => $this->cost($options),
             ]);

src/Illuminate/Hashing/BcryptValueTooLongException.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace Illuminate\Hashing;
+
+use RuntimeException;
+
+class BcryptValueTooLongException extends RuntimeException
+{
+    public function __construct(int $maxLength = BcryptHasher::MAX_BYTE_LENGTH)
+    {
+        parent::__construct("Value to hash is too long. Bcrypt only allows for a maximum length of {$maxLength} bytes. Shorten your value or use a different hashing algorithm.");
+    }
+}

tests/Hashing/HasherTest.php

@@ -7,6 +7,7 @@
 use Illuminate\Hashing\Argon2IdHasher;
 use Illuminate\Hashing\ArgonHasher;
 use Illuminate\Hashing\BcryptHasher;
+use Illuminate\Hashing\BcryptValueTooLongException;
 use Illuminate\Hashing\HashManager;
 use PHPUnit\Framework\Attributes\Depends;
 use PHPUnit\Framework\TestCase;
@@ -59,6 +60,13 @@ public function testBasicBcryptHashing()
         $this->assertTrue($this->hashManager->isHashed($value));
     }
 
+    public function testBcryptValueTooLong()
+    {
+        $this->expectException(BcryptValueTooLongException::class);
+        $hasher = new BcryptHasher(['limit_length' => true]);
+        $hasher->make(str_repeat('a', 73));
+    }
+
     public function testBasicArgon2iHashing()
     {
         $hasher = new ArgonHasher;