{"action":"closed","number":253,"pull_request":{"url":"https://api.github.com/repos/meanjs/mean/pulls/253","id":23936032,"html_url":"https://github.com/meanjs/mean/pull/253","diff_url":"https://github.com/meanjs/mean/pull/253.diff","patch_url":"https://github.com/meanjs/mean/pull/253.patch","issue_url":"https://api.github.com/repos/meanjs/mean/issues/253","number":253,"state":"closed","locked":false,"title":"Correctly encode and decode password salt","user":{"login":"rmuch","id":445316,"avatar_url":"https://avatars.githubusercontent.com/u/445316?v=3","gravatar_id":"","url":"https://api.github.com/users/rmuch","html_url":"https://github.com/rmuch","followers_url":"https://api.github.com/users/rmuch/followers","following_url":"https://api.github.com/users/rmuch/following{/other_user}","gists_url":"https://api.github.com/users/rmuch/gists{/gist_id}","starred_url":"https://api.github.com/users/rmuch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmuch/subscriptions","organizations_url":"https://api.github.com/users/rmuch/orgs","repos_url":"https://api.github.com/users/rmuch/repos","events_url":"https://api.github.com/users/rmuch/events{/privacy}","received_events_url":"https://api.github.com/users/rmuch/received_events","type":"User","site_admin":false},"body":"The user password salt should be encoded with Base64 before being saved\r\nto the database.\r\n\r\nThe current code adds an unecessary step of converting the result of\r\ncrypto.randomBytes() (which already returns a SlowBuffer) to a Base64\r\nstring and back again to a Buffer, and misses the final step of\r\nconverting the Buffer's bytes back to a Base64 string.\r\n\r\nBecause of this, the salt stored in the database is garbled. This is\r\ninconvenient when manipulating the data in a terminal or text editor.\r\n\r\nWhen generating the password hash, the crypto.pbkdf2Sync() method\r\ncreates a new Buffer directly from the data supplied. Due to the\r\nincorrect encoding of the salt, entropy is lost at this step,\r\nweakening the security of stored passwords against brute force attacks.","created_at":"2014-11-05T20:38:11Z","updated_at":"2015-03-08T12:17:44Z","closed_at":"2015-03-08T12:17:44Z","merged_at":"2015-03-08T12:17:44Z","merge_commit_sha":"602146bfd7aabb5789eccbd4e2f8c706c262c7b6","assignee":{"login":"lirantal","id":316371,"avatar_url":"https://avatars.githubusercontent.com/u/316371?v=3","gravatar_id":"","url":"https://api.github.com/users/lirantal","html_url":"https://github.com/lirantal","followers_url":"https://api.github.com/users/lirantal/followers","following_url":"https://api.github.com/users/lirantal/following{/other_user}","gists_url":"https://api.github.com/users/lirantal/gists{/gist_id}","starred_url":"https://api.github.com/users/lirantal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lirantal/subscriptions","organizations_url":"https://api.github.com/users/lirantal/orgs","repos_url":"https://api.github.com/users/lirantal/repos","events_url":"https://api.github.com/users/lirantal/events{/privacy}","received_events_url":"https://api.github.com/users/lirantal/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/meanjs/mean/pulls/253/commits","review_comments_url":"https://api.github.com/repos/meanjs/mean/pulls/253/comments","review_comment_url":"https://api.github.com/repos/meanjs/mean/pulls/comments{/number}","comments_url":"https://api.github.com/repos/meanjs/mean/issues/253/comments","statuses_url":"https://api.github.com/repos/meanjs/mean/statuses/325a19e2763dcd1be5683d98ce95f9ac343a2a9d","head":{"label":"rmuch:fix-salt-encoding","ref":"fix-salt-encoding","sha":"325a19e2763dcd1be5683d98ce95f9ac343a2a9d","user":{"login":"rmuch","id":445316,"avatar_url":"https://avatars.githubusercontent.com/u/445316?v=3","gravatar_id":"","url":"https://api.github.com/users/rmuch","html_url":"https://github.com/rmuch","followers_url":"https://api.github.com/users/rmuch/followers","following_url":"https://api.github.com/users/rmuch/following{/other_user}","gists_url":"https://api.github.com/users/rmuch/gists{/gist_id}","starred_url":"https://api.github.com/users/rmuch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmuch/subscriptions","organizations_url":"https://api.github.com/users/rmuch/orgs","repos_url":"https://api.github.com/users/rmuch/repos","events_url":"https://api.github.com/users/rmuch/events{/privacy}","received_events_url":"https://api.github.com/users/rmuch/received_events","type":"User","site_admin":false},"repo":{"id":26238072,"name":"mean","full_name":"rmuch/mean","owner":{"login":"rmuch","id":445316,"avatar_url":"https://avatars.githubusercontent.com/u/445316?v=3","gravatar_id":"","url":"https://api.github.com/users/rmuch","html_url":"https://github.com/rmuch","followers_url":"https://api.github.com/users/rmuch/followers","following_url":"https://api.github.com/users/rmuch/following{/other_user}","gists_url":"https://api.github.com/users/rmuch/gists{/gist_id}","starred_url":"https://api.github.com/users/rmuch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmuch/subscriptions","organizations_url":"https://api.github.com/users/rmuch/orgs","repos_url":"https://api.github.com/users/rmuch/repos","events_url":"https://api.github.com/users/rmuch/events{/privacy}","received_events_url":"https://api.github.com/users/rmuch/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rmuch/mean","description":"MEAN.JS - Full-Stack JavaScript Using MongoDB, Express, AngularJS, and Node.js From Creators of MEAN.IO - ","fork":true,"url":"https://api.github.com/repos/rmuch/mean","forks_url":"https://api.github.com/repos/rmuch/mean/forks","keys_url":"https://api.github.com/repos/rmuch/mean/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rmuch/mean/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rmuch/mean/teams","hooks_url":"https://api.github.com/repos/rmuch/mean/hooks","issue_events_url":"https://api.github.com/repos/rmuch/mean/issues/events{/number}","events_url":"https://api.github.com/repos/rmuch/mean/events","assignees_url":"https://api.github.com/repos/rmuch/mean/assignees{/user}","branches_url":"https://api.github.com/repos/rmuch/mean/branches{/branch}","tags_url":"https://api.github.com/repos/rmuch/mean/tags","blobs_url":"https://api.github.com/repos/rmuch/mean/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rmuch/mean/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rmuch/mean/git/refs{/sha}","trees_url":"https://api.github.com/repos/rmuch/mean/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rmuch/mean/statuses/{sha}","languages_url":"https://api.github.com/repos/rmuch/mean/languages","stargazers_url":"https://api.github.com/repos/rmuch/mean/stargazers","contributors_url":"https://api.github.com/repos/rmuch/mean/contributors","subscribers_url":"https://api.github.com/repos/rmuch/mean/subscribers","subscription_url":"https://api.github.com/repos/rmuch/mean/subscription","commits_url":"https://api.github.com/repos/rmuch/mean/commits{/sha}","git_commits_url":"https://api.github.com/repos/rmuch/mean/git/commits{/sha}","comments_url":"https://api.github.com/repos/rmuch/mean/comments{/number}","issue_comment_url":"https://api.github.com/repos/rmuch/mean/issues/comments{/number}","contents_url":"https://api.github.com/repos/rmuch/mean/contents/{+path}","compare_url":"https://api.github.com/repos/rmuch/mean/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rmuch/mean/merges","archive_url":"https://api.github.com/repos/rmuch/mean/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rmuch/mean/downloads","issues_url":"https://api.github.com/repos/rmuch/mean/issues{/number}","pulls_url":"https://api.github.com/repos/rmuch/mean/pulls{/number}","milestones_url":"https://api.github.com/repos/rmuch/mean/milestones{/number}","notifications_url":"https://api.github.com/repos/rmuch/mean/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rmuch/mean/labels{/name}","releases_url":"https://api.github.com/repos/rmuch/mean/releases{/id}","created_at":"2014-11-05T20:22:53Z","updated_at":"2014-11-05T20:22:28Z","pushed_at":"2015-03-07T22:11:40Z","git_url":"git://github.com/rmuch/mean.git","ssh_url":"git@github.com:rmuch/mean.git","clone_url":"https://github.com/rmuch/mean.git","svn_url":"https://github.com/rmuch/mean","homepage":"meanjs.org","size":2374,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"meanjs:master","ref":"master","sha":"42931d35c567aab23e39eac34a619b9f5df9eb91","user":{"login":"meanjs","id":6232122,"avatar_url":"https://avatars.githubusercontent.com/u/6232122?v=3","gravatar_id":"","url":"https://api.github.com/users/meanjs","html_url":"https://github.com/meanjs","followers_url":"https://api.github.com/users/meanjs/followers","following_url":"https://api.github.com/users/meanjs/following{/other_user}","gists_url":"https://api.github.com/users/meanjs/gists{/gist_id}","starred_url":"https://api.github.com/users/meanjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meanjs/subscriptions","organizations_url":"https://api.github.com/users/meanjs/orgs","repos_url":"https://api.github.com/users/meanjs/repos","events_url":"https://api.github.com/users/meanjs/events{/privacy}","received_events_url":"https://api.github.com/users/meanjs/received_events","type":"Organization","site_admin":false},"repo":{"id":15508537,"name":"mean","full_name":"meanjs/mean","owner":{"login":"meanjs","id":6232122,"avatar_url":"https://avatars.githubusercontent.com/u/6232122?v=3","gravatar_id":"","url":"https://api.github.com/users/meanjs","html_url":"https://github.com/meanjs","followers_url":"https://api.github.com/users/meanjs/followers","following_url":"https://api.github.com/users/meanjs/following{/other_user}","gists_url":"https://api.github.com/users/meanjs/gists{/gist_id}","starred_url":"https://api.github.com/users/meanjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meanjs/subscriptions","organizations_url":"https://api.github.com/users/meanjs/orgs","repos_url":"https://api.github.com/users/meanjs/repos","events_url":"https://api.github.com/users/meanjs/events{/privacy}","received_events_url":"https://api.github.com/users/meanjs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/meanjs/mean","description":"MEAN.JS - Full-Stack JavaScript Using MongoDB, Express, AngularJS, and Node.js - ","fork":false,"url":"https://api.github.com/repos/meanjs/mean","forks_url":"https://api.github.com/repos/meanjs/mean/forks","keys_url":"https://api.github.com/repos/meanjs/mean/keys{/key_id}","collaborators_url":"https://api.github.com/repos/meanjs/mean/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/meanjs/mean/teams","hooks_url":"https://api.github.com/repos/meanjs/mean/hooks","issue_events_url":"https://api.github.com/repos/meanjs/mean/issues/events{/number}","events_url":"https://api.github.com/repos/meanjs/mean/events","assignees_url":"https://api.github.com/repos/meanjs/mean/assignees{/user}","branches_url":"https://api.github.com/repos/meanjs/mean/branches{/branch}","tags_url":"https://api.github.com/repos/meanjs/mean/tags","blobs_url":"https://api.github.com/repos/meanjs/mean/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/meanjs/mean/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/meanjs/mean/git/refs{/sha}","trees_url":"https://api.github.com/repos/meanjs/mean/git/trees{/sha}","statuses_url":"https://api.github.com/repos/meanjs/mean/statuses/{sha}","languages_url":"https://api.github.com/repos/meanjs/mean/languages","stargazers_url":"https://api.github.com/repos/meanjs/mean/stargazers","contributors_url":"https://api.github.com/repos/meanjs/mean/contributors","subscribers_url":"https://api.github.com/repos/meanjs/mean/subscribers","subscription_url":"https://api.github.com/repos/meanjs/mean/subscription","commits_url":"https://api.github.com/repos/meanjs/mean/commits{/sha}","git_commits_url":"https://api.github.com/repos/meanjs/mean/git/commits{/sha}","comments_url":"https://api.github.com/repos/meanjs/mean/comments{/number}","issue_comment_url":"https://api.github.com/repos/meanjs/mean/issues/comments{/number}","contents_url":"https://api.github.com/repos/meanjs/mean/contents/{+path}","compare_url":"https://api.github.com/repos/meanjs/mean/compare/{base}...{head}","merges_url":"https://api.github.com/repos/meanjs/mean/merges","archive_url":"https://api.github.com/repos/meanjs/mean/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/meanjs/mean/downloads","issues_url":"https://api.github.com/repos/meanjs/mean/issues{/number}","pulls_url":"https://api.github.com/repos/meanjs/mean/pulls{/number}","milestones_url":"https://api.github.com/repos/meanjs/mean/milestones{/number}","notifications_url":"https://api.github.com/repos/meanjs/mean/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/meanjs/mean/labels{/name}","releases_url":"https://api.github.com/repos/meanjs/mean/releases{/id}","created_at":"2013-12-29T13:01:15Z","updated_at":"2015-03-08T09:23:23Z","pushed_at":"2015-03-08T12:17:44Z","git_url":"git://github.com/meanjs/mean.git","ssh_url":"git@github.com:meanjs/mean.git","clone_url":"https://github.com/meanjs/mean.git","svn_url":"https://github.com/meanjs/mean","homepage":"http://meanjs.org","size":5316,"stargazers_count":1793,"watchers_count":1793,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":530,"mirror_url":null,"open_issues_count":98,"forks":530,"open_issues":98,"watchers":1793,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/meanjs/mean/pulls/253"},"html":{"href":"https://github.com/meanjs/mean/pull/253"},"issue":{"href":"https://api.github.com/repos/meanjs/mean/issues/253"},"comments":{"href":"https://api.github.com/repos/meanjs/mean/issues/253/comments"},"review_comments":{"href":"https://api.github.com/repos/meanjs/mean/pulls/253/comments"},"review_comment":{"href":"https://api.github.com/repos/meanjs/mean/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/meanjs/mean/pulls/253/commits"},"statuses":{"href":"https://api.github.com/repos/meanjs/mean/statuses/325a19e2763dcd1be5683d98ce95f9ac343a2a9d"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"lirantal","id":316371,"avatar_url":"https://avatars.githubusercontent.com/u/316371?v=3","gravatar_id":"","url":"https://api.github.com/users/lirantal","html_url":"https://github.com/lirantal","followers_url":"https://api.github.com/users/lirantal/followers","following_url":"https://api.github.com/users/lirantal/following{/other_user}","gists_url":"https://api.github.com/users/lirantal/gists{/gist_id}","starred_url":"https://api.github.com/users/lirantal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lirantal/subscriptions","organizations_url":"https://api.github.com/users/lirantal/orgs","repos_url":"https://api.github.com/users/lirantal/repos","events_url":"https://api.github.com/users/lirantal/events{/privacy}","received_events_url":"https://api.github.com/users/lirantal/received_events","type":"User","site_admin":false},"comments":22,"review_comments":0,"commits":1,"additions":2,"deletions":2,"changed_files":1}}