Empty string in $line causes an Exception that can expose a User's password

[jamieb-tillo]

In this method, if the $line variable does not contain a colon (e.g., is an empty string), then the call to list() will throw an Exception.

password_exposed/src/AbstractPasswordExposedChecker.php

Line 147 in 327f93e

list($exposedHashSuffix, $occurrences) = explode(':', $line);

This exception is not caught by the handling in NIST or the DivineOmega packages. The stack trace of this exception will contain the submitted password in plain text.

[Neven21]

Same problem. Thanks for the fix.