In caching sha2 password xor, b length can be less than a.

[normano]

node-mysql2/lib/auth_plugins/caching_sha2_password.js

Line 35 in 93df7a8

result[i] = a[i] ^ b[i];

You could use xorRotating func to fix:
https://github.com/normano/node-mysql2/blob/72aaf4a07680d26edb5ac6bb828027207e97e004/lib/auth_41.js#L137

[sidorares]

Good catch @normano !
I wonder if mysql server actually expects xor rotated this way. Are you able to test this scenario?
Scramble is usually 20 bytes, this means you need to create a user with > 20 char password to be able to test

[normano]

There is a link to Preparing Your MySQL Community Connector in the code but the site is not currently working. You can search for "MySQL 8 caching_sha2_password xor rotated in Google to find reference to this.

…

On Wed, Oct 23, 2019, 5:12 PM Andrey Sidorov ***@***.***> wrote: Good catch @normano <https://github.com/normano> ! I wonder if mysql server actually expects xor rotated this way. Are you able to test this scenario? Scramble is usually 20 bytes, this means you need to create a user with > 20 char password to be able to test — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1044?email_source=notifications&email_token=AAHLRKCOFQSX27BAJVAN6ULQQDR6BA5CNFSM4JEDHAQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECDIOCY#issuecomment-545687307>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHLRKEKIVWQEJHKXRVGWOTQQDR6BANCNFSM4JEDHAQA> .

[normano]

https://webcache.googleusercontent.com/search?q=cache:CBqPiiqmUO4J:https://insidemysql.com/preparing-your-community-connector-for-mysql-8-part-2-sha256/+&cd=1&hl=en&ct=clnk&gl=us

…

On Wed, Oct 23, 2019, 5:16 PM Norm O ***@***.***> wrote: There is a link to Preparing Your MySQL Community Connector in the code but the site is not currently working. You can search for "MySQL 8 caching_sha2_password xor rotated in Google to find reference to this. On Wed, Oct 23, 2019, 5:12 PM Andrey Sidorov ***@***.***> wrote: > Good catch @normano <https://github.com/normano> ! > I wonder if mysql server actually expects xor rotated this way. Are you > able to test this scenario? > Scramble is usually 20 bytes, this means you need to create a user with > > 20 char password to be able to test > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <#1044?email_source=notifications&email_token=AAHLRKCOFQSX27BAJVAN6ULQQDR6BA5CNFSM4JEDHAQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECDIOCY#issuecomment-545687307>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAHLRKEKIVWQEJHKXRVGWOTQQDR6BANCNFSM4JEDHAQA> > . >

[sidorares]

Thanks, do you want to create a PR with this change? Note that currently xor function is not shared between different auth plugins, maybe worth refactoring now

[sidorares]

I think this is only affects caching_sha2_password where seed is xored against password, in all 4.1 auth scenarios both arguments to xor are sha1 hashes exactly 32 bytes.

I can confirm that current code fails to login for a user with 01234567890123456789 ( or longer ) password and logs in no issues with rolling xor ( Mysql 8.0.17, caching_sha2_password default auth )

[normano]

Just got home, I can pull in your changes and attempt to implement.