Limit maximum length of password #836
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fiammybe
added
the
security vulnerability
MekDrop
requested changes
Dec 11, 2020
There was a problem hiding this comment.
I think for this we will need to make some extra changes. F.e.: this should work also in password changing area and new user registration too. Also, not in only backend but also in frontend (see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/password#maxlength )
|
I noticed in the frontend that the password length fields are almost all - except the password reset one, that was sloppy :-). So we can safely assume that those that are using the system normally will not have a password length over 32. I will update the allowed length from 99 to 32 then. |
MekDrop
approved these changes
Dec 14, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Limit the length of the password to 99 positions. If the password is longer (and it can be sent using a direct request, the verification algorithm can take a long time to parse the value, leading to a potential DOS attack.
Issue identified as #1033373 by f1v3 on Cloudflare