BcryptUtil does not distinguish between Chinese and English special characters, such as "!".

[LiuBo-keep]

Testing revealed that even when the user password was set to "Aa@123!", it was still possible to log in across domains using "Aa@123!".

BcryptUtil version : quarkus-elytron-security-common-3.15.6.jar

Test demo：

public class Main {

  static String pas = "1234!";
  static String pass = "1234！";

  /**
   * test
   */
  public static void main(String[] args) {
    String s = BcryptUtil.bcryptHash(pas);
    boolean matches = BcryptUtil.matches(pass, s);
    System.out.println(matches);
    System.out.println("111111111111111");
    System.out.println(pas.equals(pass));

    pas.codePoints().forEach(System.out::println);
    System.out.println("----------------");
    pass.codePoints().forEach(System.out::println);
  }
} 

result:

true
111111111111111
false
49
50
51
52
33
----------------
49
50
51
52
65281

[cescoffier]

/CC @sberyozkin

[sberyozkin]

Thanks @LiuBo-keep We are analyzing it, we'll refer to your github alias. We'd also appreciate if you could forward any new findings to security@quarkus.io

[LiuBo-keep]

Thanks for your response and for looking into this issue.

I appreciate the Quarkus team's effort in analyzing the report. I will continue to investigate and will forward any additional findings, reproduction details, or related information to security@quarkus.io.

Please let me know if any further information is needed from my side.

Thanks.