Skip to content

Expand commonPasswordBaseWords with common weak passwords #899

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iamtanuj18 wants to merge 4 commits into
base: dev
Choose a base branch
from
Open

Expand commonPasswordBaseWords with common weak passwords #899

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
600976a
Expand commonPasswordBaseWords with common weak passwords
iamtanuj18 Jul 29, 2026
55a4ba8
Merge branch 'dev' of https://github.com/Garvan-Data-Science-Platform…
iamtanuj18 Jul 29, 2026
da9392c
Show specific matched word in weak-password error
iamtanuj18 Jul 29, 2026
d07ef84
Update test admin passwords to avoid new blocklist substring
iamtanuj18 Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion application/admin-client/cypress/e2e/passwordReset.cy.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ describe('Password Reset', () => {
cy.get('input[id="password"]').type('Testpassword1')
cy.get('input[id="confirmPassword"]').type('Testpassword1{enter}')
cy.contains('Invalid password').should('exist')
cy.contains('must not contain easily guessable').should('exist')
cy.contains('commonly used weak pattern').should('exist')
})

it('opens password reset page and enters non-matching passwords', () => {
Expand Down
5 changes: 3 additions & 2 deletions application/common/src/PasswordStrength.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,10 @@ export function checkPasswordStrength(password: string): PasswordStrengthResult
if (password.length < 14) {
fields.Length = { message: 'Password must be at least 14 characters' }
}
if (baseWordRegex.test(password)) {
const commonMatch = password.match(baseWordRegex)
if (commonMatch) {
fields.CommonBase = {
message: `Password must not contain easily guessable words (i.e. ${commonPasswordBaseWords.join(', ')})`,
message: `Password contains a commonly used weak pattern: "${commonMatch[0]}". Please choose something less predictable.`,
}
}
if (!/[A-Z]/.test(password)) {
Expand Down
83 changes: 78 additions & 5 deletions application/common/testing/constants.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,17 @@
export const TestUsers = {
OPERATOR_ADMIN: {
email: 'operatoradmin@example.com',
password: 'Loginforadmin1',
password: 'Loginfortests123',
id: 96,
},
ORG_ADMIN: {
email: 'admin@example.com',
password: 'Loginforadmin1',
password: 'Loginfortests123',
id: 97,
},
ORG_ADMIN_2: {
email: 'admin2@example.com',
password: 'Loginforadmin1',
password: 'Loginfortests123',
id: 101,
},
PARTICIPANT_UNANSWERED: {
Expand All @@ -37,7 +37,7 @@ export const TestUsers = {
},
STUDY_ADMIN: {
email: 'studyadmin@example.com',
password: 'Loginforadmin1',
password: 'Loginfortests123',
id: 106,
},
PASSWORD_RESET_USER: {
Expand Down Expand Up @@ -102,4 +102,77 @@ export const MIME_TYPES: Record<string, string> = {
// csv: 'text/csv'
}

export const commonPasswordBaseWords = ['Password', 'Changeme', 'Welcome']
export const commonPasswordBaseWords = [
// Numeric sequences
'000000',
'111111',
'1111111',
'11111111',
'112233',
'123123',
'123321',
'12345',
'123456',
'1234567',
'12345678',
'123456789',
'1234567890',
'12345678910',
'555555',
'654321',
'666666',
'7777777',
'987654321',

// Common words used as passwords
'Abc123',
'Admin',
'Ashley',
'Bailey',
'Baseball',
'Changeme',
'Dragon',
'Football',
'Google',
'Iloveyou',
'Jesus',
'Letmein',
'Master',
'Michael',
'Monkey',
'Mustang',
'Mynoob',
'Ninja',
'Password',
'Qwerty',
'Secret',
'Shadow',
'Sunshine',
'Superman',
'Trustno1',
'Welcome',

// Compound and modified patterns
'Aa123456',
'Aa@123456',
'Admin123',
'Admin@123',
'Admintelecom',
'P@ssw0rd',
'Pass@123',
'Passw0rd',
'Password1',

// Keyboard walks and bot-observed patterns
'123qwe',
'18atcskd2w',
'1q2w3e',
'1q2w3e4r',
'1q2w3e4r5t',
'3rjs1la7qe',
'Qazwsx',
'Qwerty1',
'Qwerty123',
'Qwertyuiop',
'Zxcvbnm',
]
2 changes: 1 addition & 1 deletion application/user-client/cypress/e2e/registration.cy.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ describe('registration', () => {
cy.get('[data-cy="reg-confirm-password"]').type('Testpassword1')
cy.get('[data-cy="reg-button"]').click()
cy.contains('Invalid password').should('exist')
cy.contains('must not contain easily guessable words').should('exist')
cy.contains('commonly used weak pattern').should('exist')
})

it('Attempt to register existing email (i.e. no invite) and get correct error message', () => {
Expand Down
Loading