Everything so far, so good. Then I ask him to use a random string as the salt (which contained a closing curly bracket). The output was definitely *not* what was expected. This example below (salt = 'changeme}') illustrates the problem:
Yes, you need to escape curly close braces in xlat expansions.
Would it be safe to say that if I add another check into the output to send a reject if the output contains a { or a } (which it never should), it should be acceptable? If so, I'll submit a PR for that. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.