Stop throwing format exceptions when password hash isn't valid

2013-02-12 18:08:38 -05:00
parent e6d911cb05
commit e2498b5270
2 changed files with 26 additions and 2 deletions
@@ -1,4 +1,5 @@
-using MileageTraker.Web.Utility;
+using System;
+using MileageTraker.Web.Utility;
 using NUnit.Framework;

 namespace Web.Tests.Membership
@@ -22,5 +23,19 @@ namespace Web.Tests.Membership
 			bool verifyHashedPassword = Crypto.VerifyHashedPassword(hashPassword, password);
 			Assert.IsTrue(verifyHashedPassword);
 		}
+
+		[Test]
+		public void VerifyHashPassword_NotBase64Hash_Test()
+		{
+			bool verifyHashedPassword = Crypto.VerifyHashedPassword("notbase64", "not a password");
+			Assert.IsFalse(verifyHashedPassword);
+		}
+
+		[Test]
+		[ExpectedException(typeof(ArgumentNullException))]
+		public void VerifyHashPassword_NullHash_Test()
+		{
+			Crypto.VerifyHashedPassword(null, "not a password");
+		}
 	}
 }
@@ -47,7 +47,16 @@ namespace MileageTraker.Web.Utility
 			if (password == null)
 				throw new ArgumentNullException("password");

-			var hashedPasswordBytes = Convert.FromBase64String(hashedPassword);
+			byte[] hashedPasswordBytes;
+			
+			try
+			{
+				hashedPasswordBytes = Convert.FromBase64String(hashedPassword);
+			}
+			catch (FormatException)
+			{
+				return false;
+			}

 			// Verify a version 0 (see comment above) password hash.