PlaintextPasswordEncoder ignores null encoded passwords

Fixes gh-7023
spring-projects · Jun 19, 2019 · b2d4fec · b2d4fec
1 parent 4a7bdc1
commit b2d4fec
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/...n/java/org/springframework/security/authentication/encoding/PlaintextPasswordEncoder.java b/...n/java/org/springframework/security/authentication/encoding/PlaintextPasswordEncoder.java
@@ -51,6 +51,9 @@ public boolean isIgnorePasswordCase() {
 	}
 
 	public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
+		if (encPass == null) {
+			return false;
+		}
 		String pass1 = encPass + "";
 
 		// Strict delimiters is false because pass2 never persisted anywhere

diff --git a/...a/org/springframework/security/authentication/encoding/PlaintextPasswordEncoderTests.java b/...a/org/springframework/security/authentication/encoding/PlaintextPasswordEncoderTests.java
@@ -70,4 +70,10 @@ public void testMergeDemerge() {
 		assertThat(demerged[0]).isEqualTo("password");
 		assertThat(demerged[1]).isEqualTo("foo");
 	}
+
+	@Test
+	public void testNull() {
+		PlaintextPasswordEncoder encoder = new PlaintextPasswordEncoder();
+		assertThat(encoder.isPasswordValid(null, "null", null)).isFalse();
+	}
 }