Loaded JSON files accept any password to create account; cannot send funds from this account

[laboon]

DESCRIPTION:
User can load JSON file to account with any password. No matter what they type in, an account will be generated.

However, users will be unable to sign transactions from that account.

TO REPRODUCE:

1. Create a new account on Polkadot-JS
2. Give password 'password'
3. Forget account
4. Load account from JSON file
5. Enter password '123456'

EXPECTED BEHAVIOR:
Error

OBSERVED BEHAVIOR:
Account is loaded into polkadot-JS

---

TO REPRODUCE:

1. Try to send funds from that account
2. Enter correct password

EXPECTED BEHAVIOR:
Funds sent

OBSERVED BEHAVIOR:
Appears as though password is rejected

[laboon]

After loading this JSON file with the incorrect password (123456), I cannot send from it even using the correct password (password). The UI just freezes momentarily.

If I try to send and enter the incorrect password 123456 it is correctly seen as an invalid password.

Essentially, if you mistype the password when loading the JSON file, you will not be able to send from that account.

[laboon]

Even after loading the JSON file with the correct password, I am unable to send any DOT from that account.

[Tbaut]

Thanks for the details Bill, taking a look.

edit: the problem is in the keyring keyring.isPassValid return true for any password.

apps/packages/page-accounts/src/modals/Import.tsx

Line 55 in eb6b82e

(password: string) => setPass({ isPassValid: keyring.isPassValid(password), password }),

edit2: This sounds like a confusion, isPassValid is indeed only checking for password length https://github.com/polkadot-js/ui/blob/64f630d904d2f32dd9e7624da376d57ac8bbe5b7/packages/ui-keyring/src/Base.ts#L92

[Tbaut]

Seeing this PR a little late, that's where things went wrong: #3758

[polkadot-js-bot]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue if you think you have a related problem or query.