password requirements #377

BLEMENT33 · 2024-03-16T13:08:01Z

Description

update our password validators to unsure new users' password are strong enough.
We need to coordinate this with Titan.

codecov · 2024-03-16T13:09:56Z

Codecov Report

Attention: Patch coverage is 87.50000% with 2 lines in your changes missing coverage. Please review.

Project coverage is 82.90%. Comparing base (57670d0) to head (20740ea).
Report is 1 commits behind head on main.

Files	Patch %	Lines
app/utils/validators.py	77.77%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #377      +/-   ##
==========================================
+ Coverage   82.87%   82.90%   +0.02%     
==========================================
  Files          98       98              
  Lines        6185     6199      +14     
==========================================
+ Hits         5126     5139      +13     
- Misses       1059     1060       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

armanddidierjean

Should we add some unit tests?

app/utils/validators.py

armanddidierjean · 2024-06-01T09:31:39Z

app/utils/validators.py

+    if len(password) < 6 or nb_number < 1 or nb_special < 1 or nb_min < 1 or nb_maj < 1:
+        raise ValueError(
+            "The password must be at least 6 characters long and contain at least one number, one special character, one majuscule and one minuscule.",
+        )
    return password.strip()


As remarked by @Rotheem, you should use strip() before the validation

And more importantly, use RegEx please

Rotheem · 2024-06-04T08:38:10Z

app/utils/validators.py

+    nb_number, nb_special, nb_maj, nb_min = 0, 0, 0, 0
+    for i in password:
+        if i.isnumeric():
+            nb_number += 1
+        elif not i.isalpha():
+            nb_special += 1
+        elif i.isupper():
+            nb_maj += 1
+        elif i.islower():
+            nb_min += 1
+
+    if len(password) < 6 or nb_number < 1 or nb_special < 1 or nb_min < 1 or nb_maj < 1:


The use of RegEx make the code cleaner.

Suggested change

nb_number, nb_special, nb_maj, nb_min = 0, 0, 0, 0

for i in password:

if i.isnumeric():

nb_number += 1

elif not i.isalpha():

nb_special += 1

elif i.isupper():

nb_maj += 1

elif i.islower():

nb_min += 1

if len(password) < 6 or nb_number < 1 or nb_special < 1 or nb_min < 1 or nb_maj < 1:

if len(password) < 6 or not (re.search(r'[a-z]',password) and re.search(r'[A-Z]',password) and re.search(r'[0-9]',password) and re.search(r'[!@#$%^&*(),.?":{}|<>]-_',password)):

armanddidierjean

We should use the same algorithm as Calypsso

gitguardian · 2024-07-18T13:59:20Z

⚠️ GitGuardian has uncovered 3 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
13092605	Triggered	Generic Password	`87ad009`	tests/test_users.py	View secret
13092606	Triggered	Generic Password	`87ad009`	tests/test_users.py	View secret
13092607	Triggered	Generic Password	`87ad009`	tests/test_users.py	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

app/app.py

assets/password_dict/commonWords.json

app/utils/validators.py

app/app.py

Bumps [psycopg[binary]](https://github.com/psycopg/psycopg) from 3.1.19 to 3.2.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/psycopg/psycopg/blob/master/docs/news.rst">psycopg[binary]'s changelog</a>.</em></p> <blockquote> <p>.. currentmodule:: psycopg</p> <p>.. index:: single: Release notes single: News</p> <h1><code>psycopg</code> release notes</h1> <h2>Future releases</h2> <p>Psycopg 3.2.2 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^</p> <ul> <li>Drop <code>!TypeDef</code> specifications as string from public modules, as they cannot be composed by users as <code>!typing</code> objects previously could (:ticket:<code>[#860](https://github.com/psycopg/psycopg/issues/860)</code>).</li> </ul> <h2>Current release</h2> <p>Psycopg 3.2.1 ^^^^^^^^^^^^^</p> <ul> <li>Fix packaging metadata breaking <code>[c]</code>, <code>[binary]</code> dependencies (:ticket:<code>[#853](https://github.com/psycopg/psycopg/issues/853)</code>).</li> </ul> <h2>Psycopg 3.2</h2> <p>.. rubric:: New top-level features</p> <ul> <li>Add support for integer, floating point, boolean <code>NumPy scalar types</code>__ (:ticket:<code>[#332](https://github.com/psycopg/psycopg/issues/332)</code>).</li> <li>Add <code>!timeout</code> and <code>!stop_after</code> parameters to <code>Connection.notifies()</code> (:ticket:<code>340</code>).</li> <li>Allow dumpers to return <code>!None</code>, to be converted to NULL (:ticket:<code>[#377](https://github.com/psycopg/psycopg/issues/377)</code>).</li> <li>Add :ref:<code>raw-query-cursors</code> to execute queries using placeholders in PostgreSQL format (<code>$1</code>, <code>$2</code>...) (🎟️<code>[#560](psycopg/psycopg#560), [#839](https://github.com/psycopg/psycopg/issues/839)</code>).</li> <li>Add <code>capabilities</code> object to :ref:<code>inspect the libpq capabilities <capabilities></code> (🎫<code>[#772](https://github.com/psycopg/psycopg/issues/772)</code>).</li> <li>Add <code>~rows.scalar_row</code> to return scalar values from a query (:ticket:<code>[#723](https://github.com/psycopg/psycopg/issues/723)</code>).</li> <li>Add <code>~Connection.cancel_safe()</code> for encrypted and non-blocking cancellation when using libpq v17. Use such method internally to implement <code>!KeyboardInterrupt</code> and <code>~cursor.copy</code> termination (:ticket:<code>[#754](https://github.com/psycopg/psycopg/issues/754)</code>).</li> <li>The <code>!context</code> parameter of <code>sql</code> objects <code>~sql.Composable.as_string()</code> and <code>~sql.Composable.as_bytes()</code> methods is now optional (:ticket:<code>[#716](https://github.com/psycopg/psycopg/issues/716)</code>).</li> <li>Add <code>~Connection.set_autocommit()</code> on sync connections, and similar</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psycopg/psycopg/commit/bb47d3944d1c65d9baf83808696aba1b2dfed9af"><code>bb47d39</code></a> chore: bump psycopg package version to 3.2.1</li> <li><a href="https://github.com/psycopg/psycopg/commit/55490a2d6b8344e3b49f6004c8e7afdc6d40c5fb"><code>55490a2</code></a> fix: fix versions in packaging metadata</li> <li><a href="https://github.com/psycopg/psycopg/commit/1cbc42a6759823e18d273e739cc64d7f994f53b2"><code>1cbc42a</code></a> docs: fix title level of major releases</li> <li><a href="https://github.com/psycopg/psycopg/commit/06a6e5e213577fca0fa1c6ca62def8fa5803663a"><code>06a6e5e</code></a> docs: mention dropping Python 3.7 in psycopg 3.2 release</li> <li><a href="https://github.com/psycopg/psycopg/commit/ea3735dccc5dfd20eb4ba5c4a3c52ec76d9aa6d0"><code>ea3735d</code></a> docs: better organization of the 3.2 release notes</li> <li><a href="https://github.com/psycopg/psycopg/commit/896eee2363d0bc25cc31ccf4189b295bb61deb40"><code>896eee2</code></a> chore: bump psycopg package version to 3.2.0</li> <li><a href="https://github.com/psycopg/psycopg/commit/2e2f4d7dd31cac67b790c293de70133373173ebb"><code>2e2f4d7</code></a> chore: bump psycopg package version to 3.1.20</li> <li><a href="https://github.com/psycopg/psycopg/commit/7369d3bb0280851832a395d6b3084de7b520e3a0"><code>7369d3b</code></a> Merge pull request <a href="https://github.com/psycopg/psycopg/issues/846">#846</a> from eli-schwartz/tomllib</li> <li><a href="https://github.com/psycopg/psycopg/commit/6672c708f1813978461aff6e5e240a96773ff873"><code>6672c70</code></a> style: shorter line in pyproject.toml</li> <li><a href="https://github.com/psycopg/psycopg/commit/a517bb4579d2b8caa4ddc1e81294d6026c8974d6"><code>a517bb4</code></a> build: avoid installing tomli on recent python</li> <li>Additional commits viewable in <a href="https://github.com/psycopg/psycopg/compare/3.1.19...3.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=psycopg[binary]&package-manager=pip&previous-version=3.1.19&new-version=3.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

BLEMENT33 linked an issue Mar 16, 2024 that may be closed by this pull request

Set password requirements #330

Open

armanddidierjean requested changes Mar 17, 2024

View reviewed changes

app/utils/validators.py Outdated Show resolved Hide resolved

app/utils/validators.py Outdated Show resolved Hide resolved

armanddidierjean added enhancement New feature or request core labels Mar 19, 2024

armanddidierjean requested changes Mar 24, 2024

View reviewed changes

app/utils/validators.py Outdated Show resolved Hide resolved

armanddidierjean force-pushed the password-requirements branch from 9355e36 to 80c212b Compare May 23, 2024 11:25

foucblg approved these changes May 31, 2024

View reviewed changes

armanddidierjean approved these changes May 31, 2024

View reviewed changes

armanddidierjean requested changes Jun 1, 2024

View reviewed changes

Rotheem reviewed Jun 4, 2024

View reviewed changes

BLEMENT33 added 7 commits July 18, 2024 14:50

password requirements

6c80466

fix

505a650

fix lint issue

28e8c3d

fix

49a647e

fix tests

e59f9da

feat : add docstring

5038110

feat : use regex verification

4efa93c

Rotheem force-pushed the password-requirements branch from ce73e26 to 4efa93c Compare July 18, 2024 13:00

armanddidierjean requested changes Jul 18, 2024

View reviewed changes

Rotheem added 2 commits July 18, 2024 15:20

Fix: correct regex

f684f0a

Feat: use zxcvbn to verfiy password strength

87ad009

armanddidierjean requested changes Jul 19, 2024

View reviewed changes

app/app.py Outdated Show resolved Hide resolved

assets/password_dict/commonWords.json Outdated Show resolved Hide resolved

app/utils/validators.py Outdated Show resolved Hide resolved

app/app.py Outdated Show resolved Hide resolved

Rotheem added 3 commits July 19, 2024 11:52

Feat: change dictionnaries discovery

a490274

Fix: correct glob expression

91ad4c4

Fix: unused import

6257a38

armanddidierjean mentioned this pull request Jul 20, 2024

Add colors to different levels of log in console #494

Merged

Rotheem and others added 2 commits July 22, 2024 11:12

Fix: add zxcvbn stubs

a882ca1

Fix: remove length check in regex and swap checks

20740ea

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

password requirements #377

password requirements #377

BLEMENT33 commented Mar 16, 2024 •

edited by armanddidierjean

Loading

codecov bot commented Mar 16, 2024 •

edited

Loading

armanddidierjean left a comment

armanddidierjean Jun 1, 2024

Rotheem Jun 3, 2024

Rotheem Jun 4, 2024 •

edited

Loading

armanddidierjean left a comment

gitguardian bot commented Jul 18, 2024 •

edited

Loading

password requirements #377

Are you sure you want to change the base?

password requirements #377

Conversation

BLEMENT33 commented Mar 16, 2024 • edited by armanddidierjean Loading

Description

codecov bot commented Mar 16, 2024 • edited Loading

Codecov Report

armanddidierjean left a comment

Choose a reason for hiding this comment

armanddidierjean Jun 1, 2024

Choose a reason for hiding this comment

Rotheem Jun 3, 2024

Choose a reason for hiding this comment

Rotheem Jun 4, 2024 • edited Loading

Choose a reason for hiding this comment

armanddidierjean left a comment

Choose a reason for hiding this comment

gitguardian bot commented Jul 18, 2024 • edited Loading

⚠️ GitGuardian has uncovered 3 secrets following the scan of your pull request.

BLEMENT33 commented Mar 16, 2024 •

edited by armanddidierjean

Loading

codecov bot commented Mar 16, 2024 •

edited

Loading

Rotheem Jun 4, 2024 •

edited

Loading

gitguardian bot commented Jul 18, 2024 •

edited

Loading