Skip to content
This repository has been archived by the owner on Oct 4, 2023. It is now read-only.

[C-781] Add minimum threshold to common password check #1684

Merged
merged 1 commit into from
Aug 5, 2022
Merged

[C-781] Add minimum threshold to common password check #1684

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
16 changes: 14 additions & 2 deletions packages/web/src/utils/commonPasswordCheck.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))

const HIBP_URL = 'https://api.pwnedpasswords.com/range/'

const API_MIN_MATCH_COUNT = 20

export const commonPasswordCheck = async (
password: string
): Promise<boolean> => {
Expand All @@ -23,8 +25,18 @@ export const commonPasswordCheck = async (
if (result) {
// @ts-ignore
const text = (await result?.text()) as string
const map = text.split(/\s+/g).map((s) => s.slice(0, s.indexOf(':')))
return map.includes(hash.slice(5))
const hashArr = text.split(/\s+/g).map((s) => s.slice(0, s.indexOf(':')))

// If there is no match, return false
if (!hashArr.includes(hash.slice(5))) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we be checking for the full hash instead of just the first 5 characters? Here and on line 35

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

opposite. this is slicing off the first 5 chars and checking the rest. this is just because of how the API returns the data

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah gotcha

return false
}

const valString = text.slice(text.indexOf(hash.slice(5))).split(/\s+/g)[0]
const count = Number(valString.split(':')[1])

// Return true if match count if above min threshold
return count >= API_MIN_MATCH_COUNT
}

// Fallback to the common password list if the api does not respond in time
Expand Down