Unclean exception handling in PasswordEncoderInterface::encodePassword()

[umulmrum]

Symfony version(s) affected: 2.4+

Description
PasswordEncoderInterface::encodePassword() doesn't declare any exceptions, yet implementations do throw some.

All built-in implementations throw BadCredentialsException if the password is excessively long.

Some implementations also throw LogicExceptions, e.g. Argon2iPasswordEncoder throws it if Argon2i isn't available).

PlaintextPasswordEncoder also throws an InvalidArgumentException if the passed salt contains invalid characters.

Possible Solution
The interface should declare all exceptions implementations are allowed to throw. I think it's safe to say that BadCredentialsException should be added.
Not sure about the others, though. Maybe ignore the fact that LogicExceptions are thrown (if we are quite sure that these exceptions only occur at dev time) and throw BadCredentialsException instead of InvalidArgumentException?

[stof]

Some implementations also throw LogicExceptions, e.g. Argon2iPasswordEncoder throws it if Argon2i isn't available).

Well, that one is not an exception you are meant to catch in places using the encoder, as they are related to a bad configuration of the project.
Saying that we should declare them in the interface would be the same than saying we could throw a TypeError if you pass a wrong argument in a method. That's not something useful for the caller (they should bubble up to the global error handler).

Adding BadCredentialsException might make sense.

[umulmrum]

OK, so one question is yet open: What to do with the InvalidArgumentException thrown in mergePasswordAndSalt()? This method is called both from encodePassword() and from isPasswordValid().

The easiest (and actually fitting) solution is to also declare it for both methods.