Security::hash() should throw an exception if algo not found

[inoas]

This is a (multiple allowed):

• bug

• enhancement

• CakePHP Version: 3.4.2

What you did

$hash = Security::hash('foobar', 'sha512a');

sha512a doesn't exist, only sha512 does (on my system).

What happened

Warning

What you expected to happen

Exception

Reason: This should break your application not just throw a warning for better security.
Result was that $hash became false. Labeled as bug just cause I consider this bad practice for security.

I could probably create a PR if I can make the test cases catch the exception.
This should probably happen for 4.x as it is non-BC?

[dereuromark]

In 3.6 the exception sure makes sense. For 3.5 we could think about triggering a warning instead.

[markstory]

Adding exceptions is acceptable as far as backwards compatibility is concerned. Would you be able to put a pull request together @inoas ?

[inoas]

I suppose I can - I'll take a look this weekend / next week.

[inoas]

Closing as PR is open.