SuperSeriousBusiness/GoToSocial
1
1
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial synced 2024-12-27 08:43:29 +01:00
Code Issues Projects Releases Wiki Activity

[feature] Include password strength in error message when password strength is too low (#550)

Browse Source 
* When password validation fails, return how close to enough entropy it has.

* Shorter version of low-strength password error message
This commit is contained in:
Eamonn O'Brien-Strain 2022-05-09 01:31:46 -07:00 committed by GitHub
parent 5004e0a9da
commit b24b71c0a4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/api/client/user/passwordchange_test.go
View File

@ -153,7 +153,7 @@ func (suite *PasswordChangeTestSuite) TestPasswordWeakNewPassword() {
defer result.Body.Close()
b, err := ioutil.ReadAll(result.Body)
suite.NoError(err)
suite.Equal(`{"error":"bad request: insecure password, try including more special characters, using uppercase letters, using numbers or using a longer password"}`, string(b))
suite.Equal(`{"error":"bad request: password is 94% strength, try including more special characters, using uppercase letters, using numbers or using a longer password"}`, string(b))
}
func TestPasswordChangeTestSuite(t *testing.T) {

4
internal/processing/user/changepassword_test.go
View File

@ -64,9 +64,9 @@ func (suite *ChangePasswordTestSuite) TestChangePasswordWeakNew() {
user := suite.testUsers["local_account_1"]
errWithCode := suite.user.ChangePassword(context.Background(), user, "password", "1234")
suite.EqualError(errWithCode, "insecure password, try including more special characters, using lowercase letters, using uppercase letters or using a longer password")
suite.EqualError(errWithCode, "password is 11% strength, try including more special characters, using lowercase letters, using uppercase letters or using a longer password")
suite.Equal(http.StatusBadRequest, errWithCode.Code())
suite.Equal("bad request: insecure password, try including more special characters, using lowercase letters, using uppercase letters or using a longer password", errWithCode.Safe())
suite.Equal("bad request: password is 11% strength, try including more special characters, using lowercase letters, using uppercase letters or using a longer password", errWithCode.Safe())
}
func TestChangePasswordTestSuite(t *testing.T) {

12
internal/validate/formvalidation.go
View File

@ -22,6 +22,7 @@ import (
"errors"
"fmt"
"net/mail"
"strings"
apimodel "github.com/superseriousbusiness/gotosocial/internal/api/model"
"github.com/superseriousbusiness/gotosocial/internal/regexes"
@ -53,7 +54,16 @@ func NewPassword(password string) error {
return fmt.Errorf("password should be no more than %d chars", maximumPasswordLength)
}
return pwv.Validate(password, minimumPasswordEntropy)
if err := pwv.Validate(password, minimumPasswordEntropy); err != nil {
// Modify error message to include percentage requred entropy the password has
percent := int(100 * pwv.GetEntropy(password) / minimumPasswordEntropy)
return errors.New(strings.ReplaceAll(
err.Error(),
"insecure password",
fmt.Sprintf("password is %d%% strength", percent)))
}
return nil // pasword OK
}
// Username makes sure that a given username is valid (ie., letters, numbers, underscores, check length).

8
internal/validate/formvalidation_test.go
View File

@ -50,22 +50,22 @@ func (suite *ValidationTestSuite) TestCheckPasswordStrength() {
err = validate.NewPassword(terriblePassword)
if assert.Error(suite.T(), err) {
assert.Equal(suite.T(), errors.New("insecure password, try including more special characters, using uppercase letters, using numbers or using a longer password"), err)
assert.Equal(suite.T(), errors.New("password is 62% strength, try including more special characters, using uppercase letters, using numbers or using a longer password"), err)
}
err = validate.NewPassword(weakPassword)
if assert.Error(suite.T(), err) {
assert.Equal(suite.T(), errors.New("insecure password, try including more special characters, using numbers or using a longer password"), err)
assert.Equal(suite.T(), errors.New("password is 95% strength, try including more special characters, using numbers or using a longer password"), err)
}
err = validate.NewPassword(shortPassword)
if assert.Error(suite.T(), err) {
assert.Equal(suite.T(), errors.New("insecure password, try including more special characters or using a longer password"), err)
assert.Equal(suite.T(), errors.New("password is 39% strength, try including more special characters or using a longer password"), err)
}
err = validate.NewPassword(specialPassword)
if assert.Error(suite.T(), err) {
assert.Equal(suite.T(), errors.New("insecure password, try including more special characters or using a longer password"), err)
assert.Equal(suite.T(), errors.New("password is 53% strength, try including more special characters or using a longer password"), err)
}
err = validate.NewPassword(longPassword)