From b7133e984172882cd66663e8be92c556009b1ecb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Efe=20G=C3=B6kdemir?= <efe@rexcode.co.uk>
Date: Wed, 23 Sep 2026 14:10:55 +0300
Subject: [PATCH] [CODEC-245] Reject malformed Sha2Crypt salt syntax

Require the optional rounds clause and salt suffix to use the documented separators and character set. Add regression coverage for malformed rounds text and non-ASCII salt input.
---
 src/main/java/org/apache/commons/codec/digest/Sha2Crypt.java  | 2 +-
 .../java/org/apache/commons/codec/digest/Sha512CryptTest.java | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/apache/commons/codec/digest/Sha2Crypt.java b/src/main/java/org/apache/commons/codec/digest/Sha2Crypt.java
index 5325ee30bf..4d8a596007 100644
--- a/src/main/java/org/apache/commons/codec/digest/Sha2Crypt.java
+++ b/src/main/java/org/apache/commons/codec/digest/Sha2Crypt.java
@@ -87,7 +87,7 @@ public class Sha2Crypt {
 
     /** The pattern to match valid salt values. */
     private static final Pattern SALT_PATTERN = Pattern
-            .compile("^\\$([56])\\$(rounds=(\\d+)\\$)?([\\.\\/a-zA-Z0-9]{1,16}).*");
+            .compile("^\\$([56])\\$(rounds=(\\d+)\\$)?([\\.\\/a-zA-Z0-9]{1,16})[\\.\\/a-zA-Z0-9]*(?:\\$.*)?$");
 
     /**
      * Finds the first non-zero digit, retaining one zero for an all-zero value.
diff --git a/src/test/java/org/apache/commons/codec/digest/Sha512CryptTest.java b/src/test/java/org/apache/commons/codec/digest/Sha512CryptTest.java
index f1eefd2ac0..c645444355 100644
--- a/src/test/java/org/apache/commons/codec/digest/Sha512CryptTest.java
+++ b/src/test/java/org/apache/commons/codec/digest/Sha512CryptTest.java
@@ -50,6 +50,10 @@ void testSha2CryptRounds() {
     @Test
     void testSha2CryptWrongSalt() {
         assertThrows(IllegalArgumentException.class, () -> Sha2Crypt.sha512Crypt("secret".getBytes(StandardCharsets.UTF_8), "xx"));
+        assertThrows(IllegalArgumentException.class,
+                () -> Sha2Crypt.sha256Crypt("secret".getBytes(StandardCharsets.UTF_8), "$5$notrounds=1000$asdfasdf"));
+        assertThrows(IllegalArgumentException.class,
+                () -> Sha2Crypt.sha512Crypt("secret".getBytes(StandardCharsets.UTF_8), "$6$rounds=1000$äöüäöü"));
     }
 
     @Test