# Does storing plain data length leak essential information about the cryptographic scheme?

Consider the function below:

 def dec args=password, iv, encrypted
decipher = OpenSSL::Cipher.new('aes-128-cbc')
decipher.decrypt
decipher.key = Digest::SHA256.hexdigest(password) # just for simplicity;  use PBKDF2 for real applications
decipher.iv = Base64.decode64(iv)
plain = decipher.update(Base64.decode64(encrypted)) + decipher.final
return plain
end


That function will correctly decipher a text, but it may add extra invisible chars, depending on the size of the original plain text. Then, the length must be stored in the file, together with encrypted and iv, and the decryption function becomes:

 def dec args=password, iv, encrypted, length
decipher = OpenSSL::Cipher.new('aes-128-cbc')
decipher.decrypt
decipher.key = Digest::SHA256.hexdigest(password) # just for simplicity;  use PBKDF2 for real applications
decipher.iv = Base64.decode64(iv)
plain = decipher.update(Base64.decode64(encrypted)) + decipher.final
return plain[0..(length-1)]
end


I suspect that the storing of the length in the encrypted file be a cryptographic weakness. What's the proper way of solving it?