#364 Add test for bogus hashes

- Verify that a "hash" in the wrong format doesn't throw exception (this is relevant when the supportOldPasswordHash setting is enabled)

src/main/java/fr/xephi/authme/security/crypts/BCRYPT.java

@@ -13,11 +13,13 @@
 // OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 package fr.xephi.authme.security.crypts;
 
+import fr.xephi.authme.ConsoleLogger;
 import fr.xephi.authme.security.crypts.description.HasSalt;
 import fr.xephi.authme.security.crypts.description.Usage;
 import fr.xephi.authme.security.crypts.description.Recommendation;
 import fr.xephi.authme.security.crypts.description.SaltType;
 import fr.xephi.authme.settings.Settings;
+import fr.xephi.authme.util.StringUtils;
 
 import java.io.UnsupportedEncodingException;
 import java.security.SecureRandom;
@@ -527,7 +529,12 @@ public class BCRYPT implements EncryptionMethod {
 
     @Override
     public boolean comparePassword(String password, HashedPassword hash, String name) {
-        return checkpw(password, hash.getHash());
+        try {
+            return hash.getHash().length() > 3 && checkpw(password, hash.getHash());
+        } catch (IllegalArgumentException e) {
+            ConsoleLogger.showError("Bcrypt checkpw() returned " + StringUtils.formatException(e));
+        }
+        return false;
     }
 
     @Override

src/main/java/fr/xephi/authme/security/crypts/CryptPBKDF2.java

@@ -22,6 +22,9 @@ public class CryptPBKDF2 extends HexSaltedMethod {
     @Override
     public boolean comparePassword(String password, HashedPassword hashedPassword, String unusedName) {
         String[] line = hashedPassword.getHash().split("\\$");
+        if (line.length != 4) {
+            return false;
+        }
         String salt = line[2];
         String derivedKey = line[3];
         PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), 10000, derivedKey.getBytes());

src/main/java/fr/xephi/authme/security/crypts/CryptPBKDF2Django.java

@@ -21,6 +21,9 @@ public class CryptPBKDF2Django extends HexSaltedMethod {
     @Override
     public boolean comparePassword(String password, HashedPassword hashedPassword, String unusedName) {
         String[] line = hashedPassword.getHash().split("\\$");
+        if (line.length != 4) {
+            return false;
+        }
         String salt = line[2];
         byte[] derivedKey = DatatypeConverter.parseBase64Binary(line[3]);
         PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), 15000, derivedKey);

src/main/java/fr/xephi/authme/security/crypts/WHIRLPOOL.java

@@ -379,6 +379,7 @@ public class WHIRLPOOL extends UnsaltedMethod {
         }
     }
 
+    @Override
     public String computeHash(String password) {
         byte[] digest = new byte[DIGESTBYTES];
         NESSIEinit();

src/main/java/fr/xephi/authme/security/crypts/XAUTH.java

@@ -26,8 +26,11 @@ public class XAUTH extends HexSaltedMethod {
     public boolean comparePassword(String password, HashedPassword hashedPassword, String playerName) {
         String hash = hashedPassword.getHash();
         int saltPos = (password.length() >= hash.length() ? hash.length() - 1 : password.length());
-        String saltFromHash = hash.substring(saltPos, saltPos + 12);
-        return hash.equals(computeHash(password, saltFromHash, null));
+        if (saltPos + 12 > hash.length()) {
+            return false;
+        }
+        String salt = hash.substring(saltPos, saltPos + 12);
+        return hash.equals(computeHash(password, salt, null));
     }
 
     @Override