113 lines
3.3 KiB
Ruby
113 lines
3.3 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'spec_helper'
|
|
|
|
RSpec.describe Security::WeakPasswords do
|
|
describe "#weak_for_user?" do
|
|
using RSpec::Parameterized::TableSyntax
|
|
|
|
let(:user) do
|
|
build_stubbed(:user, username: "56d4ab689a_win",
|
|
name: "Weakést McWeaky-Pass Jr",
|
|
email: "predictāble.ZZZ+seventeen@examplecorp.com",
|
|
public_email: "fortunate@acme.com"
|
|
)
|
|
end
|
|
|
|
where(:password, :too_weak) do
|
|
# A random password is not too weak
|
|
"d2262d56" | false
|
|
|
|
# The case-insensitive weak password list
|
|
"password" | true
|
|
"pAssWord" | true
|
|
"princeofdarkness" | true
|
|
|
|
# Forbidden substrings
|
|
"A1B2gitlabC3" | true
|
|
"gitlab123" | true
|
|
"theonedevopsplatform" | true
|
|
"A1gitlib" | false
|
|
|
|
# Predicatable name substrings
|
|
"Aweakést" | true
|
|
"!@mCwEaKy" | true
|
|
"A1B2pass" | true
|
|
"A1B2C3jr" | false # jr is too short
|
|
|
|
# Predictable username substrings
|
|
"56d4ab689a" | true
|
|
"56d4ab689a_win" | true
|
|
"56d4ab68" | false # it's part of the username, but not a full part
|
|
"A1B2Cwin" | false # win is too short
|
|
|
|
# Predictable user.email substrings
|
|
"predictāble.ZZZ+seventeen@examplecorp.com" | true
|
|
"predictable.ZZZ+seventeen@examplecorp.com" | true
|
|
"predictāble.ZZZ+seventeen" | true
|
|
"examplecorp.com" | true
|
|
"!@exAmplecorp" | true
|
|
"predictāble123" | true
|
|
"seventeen" | true
|
|
"predictable" | false # the accent is different
|
|
"A1B2CZzZ" | false # ZZZ is too short
|
|
# Other emails are not considered
|
|
"fortunate@acme.com" | false
|
|
"A1B2acme" | false
|
|
"fortunate" | false
|
|
|
|
# A short password is not automatically too weak
|
|
# We rely on User's password length validation, not WeakPasswords.
|
|
"1" | false
|
|
"1234567" | false
|
|
# But a short password with forbidden words or user attributes
|
|
# is still weak
|
|
"gitlab" | true
|
|
"pass" | true
|
|
end
|
|
|
|
with_them do
|
|
it { expect(subject.weak_for_user?(password, user)).to eq(too_weak) }
|
|
end
|
|
|
|
context 'with a user who has short email parts' do
|
|
before do
|
|
user.email = 'sid@1.io'
|
|
end
|
|
|
|
where(:password, :too_weak) do
|
|
"11111111" | true # This is on the weak password list
|
|
"1.ioABCD" | true # 1.io is long enough to match
|
|
"sid@1.io" | true # matches the email in full
|
|
"sid@1.ioAB" | true
|
|
# sid, 1, and io on their own are too short
|
|
"sid1ioAB" | false
|
|
"sidsidsi" | false
|
|
"ioioioio" | false
|
|
end
|
|
|
|
with_them do
|
|
it { expect(subject.weak_for_user?(password, user)).to eq(too_weak) }
|
|
end
|
|
end
|
|
|
|
context 'with a user who is missing attributes' do
|
|
before do
|
|
user.name = nil
|
|
user.email = nil
|
|
user.username = nil
|
|
end
|
|
|
|
where(:password, :too_weak) do
|
|
"d2262d56" | false
|
|
"password" | true
|
|
"gitlab123" | true
|
|
end
|
|
|
|
with_them do
|
|
it { expect(subject.weak_for_user?(password, user)).to eq(too_weak) }
|
|
end
|
|
end
|
|
end
|
|
end
|