PasswordComparedWithFreshHash

warning native on by default quick-fix PHP ≥ 5.5

Group: Security

Detect password_hash result compared for equality with a stored string hash to decide password acceptance.

Example

Before

<?php
function bad($password, $stored) { if (password_hash($password, PASSWORD_DEFAULT) === $stored) { return true; } return false; }

After fix

<?php
function bad($password, $stored) { if (password_verify($password, $stored)) { return true; } return false; }

Reported:

• line 2: Verify the password against the stored hash.

Detection

• Report password_hash result compared for equality with a stored string hash to decide password acceptance.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• password_verify, hashes used only for storage, explicit non-password comparison and unknown builtin targets are excluded.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.
• A comparison whose other operand is known to be false, null, true, an integer or float literal, an array literal or the empty string is a hashing-failure or sanity check, not a comparison with a stored hash. This holds for the operand as written and for a local variable resolved to such a value, and whether the fresh hash is written inline or read from a variable. No report, hence no fix.

Fix

Replace equality with password_verify(password, stored) only for a strict equality with resolved PASSWORD_DEFAULT or PASSWORD_BCRYPT, omitted or known empty options, valid argument binding and side-effect-free operands. Unknown algorithm or option validity withholds the fix.

A fix is offered only when the concrete prerequisites above are proven. Edits use exact source byte ranges, preserve comments and argument evaluation order, and introduce syntax supported by the configured PHP version. Never invent error-handling policy.

PHP versions

Available from PHP 5.5. Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "PasswordComparedWithFreshHash": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PasswordComparedWithFreshHash