Add validation constraints to _core_config_info

Looking good already 😊

Aren't these hashes consistently of a certain length?

It's hard to tell. The hashing code is this:

    $hash = base64_encode(hash('sha256', $data, TRUE));
    // Modify the hash so it's safe to use in URLs.
    return str_replace(['+', '/', '='], ['-', '_', ''], $hash);

Since the hash is base64-encoded (for some reason), I cannot reliably tell what its length will be, and I'm not sure what a minimum valid length would be for an encoded SHA-256 hash. (I know that the hash itself has a deterministic length, but the base64 encoding of that hash?)

Aren't these hashes consistently of a certain length?

It's hard to tell. The hashing code is this:

 $hash = base64_encode(hash('sha256', $data, TRUE));
    // Modify the hash so it's safe to use in URLs.
    return str_replace(['+', '/', '='], ['-', '_', ''], $hash);

Since the hash is base64-encoded (for some reason), I cannot reliably tell what its length will be, and I'm not sure what a minimum valid length would be for an encoded SHA-256 hash. (I know that the hash itself has a deterministic length, but the base64 encoding of that hash?)

I checked this with @znerol and @dawehner at drupal dev days in Vienna, we figured out that the length of the string is always 43 characters, we tested this with a sha of all zeroes, and one with all ones, and they all come out to a string of 44 characters, which includes one padding character. We also checked the RFC for base64: http://www.faqs.org/rfcs/rfc2045.html (chapter 6.8).

Here is a 3v4l with some of the code we used for verifying this. https://3v4l.org/AhYfp
I will leave out the python and other attempts we made at checking this.

So I think this means we can check for the exact length, and it should always be 43.

Feedback addressed. Back to review!

Look great!

lauriii → credited dawehner → .

lauriii → credited znerol → .

Committed 4dcc2b2 and pushed to 11.x. Thanks!

Wonderful! 🤩 Thanks for pushing this one across the finish line, everyone! 😊

Automatically closed - issue fixed for 2 weeks with no activity.