Quantcast
Channel: Adobe Community : Unanswered Discussions - ColdFusion
Viewing all articles
Browse latest Browse all 5794

Tempered encryption causing Decrypt to crash

$
0
0

I have made an encryption of "auth" using AES as follows:

 

<cfset skey = generateSecretKey("AES")>
<cfset regkey = encrypt("auth", skey, "AES", "hex")>

 

I attached the result for example to an URL

 

http://www.mydomain.com/authorization.htm?auth=34D3795AA3696B7F81AEFE414DCA7392FDCC50AFE9D 0312B2B2530A985386B83

 

(auth is assign regkey   i.e. ,,,,,,htm?auth=#regkey#)

 

This works perfectly under perfect condition.  However, if I go ahead and try to "hack" the code and make it shorter and change some characters like this:

 

http://www.mydomain.com/authorization.htm?auth=453424AEFE414DCA7392FDCC50AFE9D0312B2B2530A 985386B83

 

The Decrypt function:

 

<cfset theword=decrypt(url.auth, skey, "AES", "hex")>

 

just crash! It throws an exception. Isn't it supposed to just return bad string rather than crashing?  This is pretty bad.

 

Is there way to check for the URL.auth before passing to Decrypt?  Thanks in advance.


Viewing all articles
Browse latest Browse all 5794

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>