awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3461 from Infisical/ENG-2623

Browse Source 
Removed low entropy password regexes that threw false positives
This commit is contained in:
Andrey
2025-04-21 22:25:58 -04:00
committed by GitHub
parent c783fa32e9 f7d35e61f7
commit 2cff90913b
2 changed files with 1 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
frontend/src/components/utilities/checks/password/checkPassword.ts
View File

@@ -31,7 +31,7 @@ interface CheckPasswordParams {
* - Contains at least 1 number (0-9) or special character (emojis included)
* - Does not contain 3 repeat, consecutive characters
* - Does not contain any escape characters/sequences
* - Does not contain PII and/or low entropy data (eg. email address, URL, phone number, DoB, SSN, driver's license, passport)
* - Does not contain PII and/or low entropy data (eg. email address, URL, SSN)
* - Is not in a database of breached passwords
*
* The function returns whether or not the password [password]

12
frontend/src/components/utilities/checks/password/passwordRegexes.ts
View File

@@ -20,18 +20,6 @@ export const lowEntropyRegexes = [
// URL (incl. subdomains, paths, top-level domains & query params)
/^(?:(?:https?|ftp):\/\/)?(?:\w+\.)?[a-zA-Z0-9.-]+\.(?:com|org|net|edu)(?:\/\S*)?(?:\?\S*)?$/,
// Date in various formats
/(\b\d{1,4}[-/.]?\d{1,2}[-/.]?\d{1,4}\b)|(\b\d{1,4}[-/.]?\w{3}[-/.]?\d{1,4}\b)/,
// Phone numbers (generalized)
/(?:\+(?:[1-9]\d{0,2})\s?)?(?:\(\d{1,4}\)\s?)?(?:\d[-.\s]?){5,}\d/,
// Passport numbers (generalized)
/\b(?:[A-Z0-9]{6,9}|[A-Z0-9]{8,9}|[A-Z0-9]{9}|[A-Z0-9]{10,11})\b/,
// Driver's license numbers (generalized)
/\b(?:[A-Z0-9]{7,10}|[A-Z0-9]{10,11}|[A-Z0-9]{7,10})\b/,
// US social security number
/\b\d{3}[-\s]?\d{2}[-\s]?\d{4}\b/
];