[11.x] Prevents Bcrypt hashing from spilling over and creating insecure hashes.

src/Illuminate/Hashing/BcryptHasher.php

@@ -8,6 +8,11 @@
 
 class BcryptHasher extends AbstractHasher implements HasherContract
 {
+    /**
+     * The maximum length of the string that can be hashed by bcrypt.
+     */
+    const BCRYPT_STR_LIMIT = 72;
+
     /**
      * The default cost factor.
      *
@@ -46,6 +51,10 @@ public function __construct(array $options = [])
     public function make(#[\SensitiveParameter] $value, array $options = [])
     {
         try {
+            if (strlen($value) > self::BCRYPT_STR_LIMIT) {
+                throw new BcryptValueTooLongException;
+            }
+
             $hash = password_hash($value, PASSWORD_BCRYPT, [
                 'cost' => $this->cost($options),
             ]);

src/Illuminate/Hashing/BcryptValueTooLongException.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace Illuminate\Hashing;
+
+use RuntimeException;
+
+class BcryptValueTooLongException extends RuntimeException
+{
+    public function __construct(int $maxLength = BcryptHasher::BCRYPT_STR_LIMIT)
+    {
+        parent::__construct("Value to hash is too long. Bcrypt only allows for a maximum length of {$maxLength} characters. Shorten your value or use a different hashing algorithm.");
+    }
+}

tests/Hashing/HasherTest.php

@@ -7,6 +7,7 @@
 use Illuminate\Hashing\Argon2IdHasher;
 use Illuminate\Hashing\ArgonHasher;
 use Illuminate\Hashing\BcryptHasher;
+use Illuminate\Hashing\BcryptValueTooLongException;
 use Illuminate\Hashing\HashManager;
 use PHPUnit\Framework\Attributes\Depends;
 use PHPUnit\Framework\TestCase;
@@ -59,6 +60,13 @@ public function testBasicBcryptHashing()
         $this->assertTrue($this->hashManager->isHashed($value));
     }
 
+    public function testBcryptTooLongValue()
+    {
+        $this->expectException(BcryptValueTooLongException::class);
+
+        (new BcryptHasher())->make(str_repeat('a', 73));
+    }
+
     public function testBasicArgon2iHashing()
     {
         $hasher = new ArgonHasher;