bcrypt will encrypt anything, so validate_presence_of would not catch nil / blank passwords. Thank you to Aleksander Kamil Modzelewski for reporting this

1 files changed, 12 insertions, 0 deletions

diff --git a/activemodel/test/cases/secure_password_test.rb b/activemodel/test/cases/secure_password_test.rb
index 4a47a7a226..c455cf57b3 100644
--- a/activemodel/test/cases/secure_password_test.rb
+++ b/activemodel/test/cases/secure_password_test.rb
@@ -9,6 +9,18 @@ class SecurePasswordTest < ActiveModel::TestCase
     @user = User.new
   end
 
+  test "blank password" do
+    user = User.new
+    user.password = ''
+    assert !user.valid?, 'user should be invalid'
+  end
+
+  test "nil password" do
+    user = User.new
+    user.password = nil
+    assert !user.valid?, 'user should be invalid'
+  end
+
   test "password must be present" do
     assert !@user.valid?
     assert_equal 1, @user.errors.size