Log invalid challenge and ignore JSON error during login (#9278)

* Log and block invalid challenge formats during login

Fixes some unexpected behaviors during a user login, including strange errors in the log related to JSON.

* Ignore JSON decode errors for URL unserializing

* Document the format a bit

app/Models/FormAuth.php

@@ -11,6 +11,12 @@ class FreshRSS_FormAuth {
 			return false;
 		}
 
+		// Expecting bcrypt format, see: https://en.wikipedia.org/wiki/Bcrypt#Description
+		if (!preg_match('/^\$2[aby]\$(0[4-9]|10)\$[.\/0-9A-Za-z]{53}$/', $challenge)) {
+			Minz_Log::debug("Invalid challenge format: user={$username}, challenge={$challenge}, nonce={$nonce}");
+			return false;
+		}
+
 		return password_verify($hash . $nonce, $challenge);
 	}
 

lib/Minz/Url.php

@@ -140,7 +140,7 @@ class Minz_Url {
 
 	/** @return array{c?:string,a?:string,params?:array<string,mixed>} */
 	public static function unserialize(string $url = ''): array {
-		$result = json_decode(base64_decode($url, true) ?: '', associative: true, flags: JSON_THROW_ON_ERROR) ?? [];
+		$result = json_decode(base64_decode($url, true) ?: '', associative: true) ?? [];
 		/** @var array{c?:string,a?:string,params?:array<string,mixed>} $result */
 		return $result;
 	}