zxcvbn-ruby 2.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da4a05d3abd0061434bb0bcedfa1992a9e975c479a0fa9679f9b7c139ea1fa1a
-  data.tar.gz: c7a0a8aa222f29b4550e636701e23069599497290c0fb23edddfc7dbfc37fec5
+  metadata.gz: ba194667b2557bfc70fe0bae1294067b9d0ce0806bd02d9fdca7d7a4e5c13d0f
+  data.tar.gz: 2cf420153522153586d434a30d216ae7b115971e97ff76ec33e10870eaef1fcd
 SHA512:
-  metadata.gz: 5fcabd8ce5ebe85f5127225c27f1fea83bf26c80885e7f4470d037f8d2c35bda07c8886f185627ee1fdf99feabb7d29ccafba80322257b1724b2c6fc7fc1352a
-  data.tar.gz: 559d0b16b68a68890e898992ef11c2e45c499ab0772d928313a3ab01767c8c251002e136b80eb7ac90d8155ea7e2432d9fb6bae1c47f0d3876b8f623a1bde9bc
+  metadata.gz: 85b798676bab221fd1c1bcd3d822305a1f0772ff13291e2b8a475d2dba5f6b0c3bd1ff0cf724913cf63b7ce7f7db14a95b563e06079c1e34d06497779a7c4368
+  data.tar.gz: 5d97602b0d05a1b4bd5afe263cc5ecc1f384df5bc4470d9321fb6029981cc5a4c5d35c4c87474154eba6545d63a66a1d0e5ff9e30224f45343b104ad9a72a221

data/CHANGELOG.md

@@ -6,7 +6,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-[Unreleased]: https://github.com/envato/zxcvbn-ruby/compare/v2.0.0...HEAD
+[Unreleased]: https://github.com/envato/zxcvbn-ruby/compare/v2.0.1...HEAD
+
+## [2.0.1] - 2026-07-11
+
+### Fixed
+ - `NoMethodError` in `Scorer` for passwords containing characters whose lowercased form is longer than the original (e.g. "İ" U+0130 downcases to "i" plus a combining dot). Dictionary and l33t matchers now lowercase per character, keeping match indices aligned with the original password. Dictionary word ranking applies the same normalisation, so user-input words containing such characters now match ([#124])
+
+[2.0.1]: https://github.com/envato/zxcvbn-ruby/compare/v2.0.0...v2.0.1
+[#124]: https://github.com/envato/zxcvbn-ruby/pull/124
 
 ## [2.0.0] - 2026-05-28
 

data/lib/zxcvbn/case_helpers.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Zxcvbn
+  # Shared helper for lowercasing strings without changing their length.
+  # @api private
+  module CaseHelpers
+    module_function
+
+    # String#downcase can grow a string — "İ" (U+0130) downcases to "i" plus
+    # combining dot above (U+0069 U+0307). Matchers rely on the lowercased
+    # password sharing the original's character indices, so a grown string
+    # sends out-of-range match positions to the scorer. When lengths diverge,
+    # fall back to per-character downcasing, truncating any multi-character
+    # mapping to its first character to keep positions aligned 1:1.
+    #
+    # @param string [String]
+    # @return [String] lowercased string with the same character length
+    def downcase_preserving_length(string)
+      lowercased = string.downcase
+      return lowercased if lowercased.length == string.length
+
+      string.each_char.map { |char| char.downcase[0] }.join
+    end
+  end
+end

data/lib/zxcvbn/dictionary_ranker.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'zxcvbn/case_helpers'
+
 module Zxcvbn
   # Converts raw word lists into frequency-ranked dictionaries for matcher use.
   # @api private
@@ -21,7 +23,9 @@ module Zxcvbn
     def self.rank_dictionary(words)
       words
         .each_with_index
-        .with_object({}) { |(word, i), dictionary| dictionary[word.downcase] = i + 1 }
+        .with_object({}) do |(word, i), dictionary|
+          dictionary[CaseHelpers.downcase_preserving_length(word)] = i + 1
+        end
     end
   end
 end

data/lib/zxcvbn/matchers/dictionary.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'zxcvbn/case_helpers'
 require 'zxcvbn/match_builder'
 
 module Zxcvbn
@@ -8,6 +9,7 @@ module Zxcvbn
     # a ranked dictionary.
     # @api private
     class Dictionary
+      include CaseHelpers
       # @param name [String] dictionary identifier used in match results
       # @param ranked_dictionary [Hash{String => Integer}] lowercased word → rank
       # @param trie [Trie, nil] optional prefix trie for faster lookups
@@ -22,7 +24,7 @@ module Zxcvbn
       # @param password [String]
       # @return [Array<MatchBuilder>] matches with pattern "dictionary"
       def matches(password)
-        lowercased_password = password.downcase
+        lowercased_password = downcase_preserving_length(password)
 
         if @trie
           trie_matches(password, lowercased_password)

data/lib/zxcvbn/matchers/l33t.rb

@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 
+require 'zxcvbn/case_helpers'
+
 module Zxcvbn
   module Matchers
     # Matches dictionary words after substituting common l33t-speak character
     # replacements (e.g. "@" for "a", "3" for "e").
     # @api private
     class L33t
+      include CaseHelpers
       # Mapping from plain letter to the l33t characters that can represent it.
       L33T_TABLE = {
         'a' => ['4', '@'].freeze,
@@ -33,7 +36,7 @@ module Zxcvbn
       # @return [Array<MatchBuilder>] matches with pattern "dictionary" and l33t: true
       def matches(password)
         matches = []
-        lowercased_password = password.downcase
+        lowercased_password = downcase_preserving_length(password)
         relevent_subtable = relevent_l33t_subtable(lowercased_password)
 
         # Early bailout: if no l33t characters present, return empty matches

data/lib/zxcvbn/scorer.rb

@@ -61,7 +61,13 @@ module Zxcvbn
 
       return build_score(password, [], 1.0) if n.zero?
 
-      # index matches by their last character
+      # Index matches by their last character (j). matches_by_j is sized to the
+      # password, so this relies on every match satisfying 0 <= m.j < n (and
+      # 0 <= m.i <= m.j) — match indices must be positions in `password`.
+      # Matchers uphold this by matching against a lowercased view that keeps the
+      # original character length; see CaseHelpers.downcase_preserving_length. A
+      # match with j >= n reads a nil slot below and raises NoMethodError, so any
+      # new matcher must preserve this invariant.
       matches_by_j = Array.new(n) { [] }
       matches.each { |m| matches_by_j[m.j] << m }
       matches_by_j.each { |arr| arr.sort_by!(&:i) }

data/lib/zxcvbn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Zxcvbn
-  VERSION = '2.0.0'
+  VERSION = '2.0.1'
 end

data/sig/zxcvbn/case_helpers.rbs

@@ -0,0 +1,5 @@
+module Zxcvbn
+  module CaseHelpers
+    def self?.downcase_preserving_length: (String string) -> String
+  end
+end

data/sig/zxcvbn/matchers/dictionary.rbs

@@ -1,6 +1,8 @@
 module Zxcvbn
   module Matchers
     class Dictionary
+      include CaseHelpers
+
       @name: String
       @ranked_dictionary: Data::ranked_dictionary
       @trie: Trie?

data/sig/zxcvbn/matchers/l33t.rbs

@@ -1,6 +1,8 @@
 module Zxcvbn
   module Matchers
     class L33t
+      include CaseHelpers
+
       L33T_TABLE: Hash[String, Array[String]]
 
       @dictionary_matchers: Array[Dictionary]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: zxcvbn-ruby
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - Steve Hodgkiss
@@ -32,6 +32,7 @@ files:
 - data/frequency_lists/surnames.txt
 - data/frequency_lists/us_tv_and_film.txt
 - lib/zxcvbn.rb
+- lib/zxcvbn/case_helpers.rb
 - lib/zxcvbn/clock.rb
 - lib/zxcvbn/crack_time.rb
 - lib/zxcvbn/data.rb
@@ -61,6 +62,7 @@ files:
 - lib/zxcvbn/version.rb
 - sig/README.md
 - sig/zxcvbn.rbs
+- sig/zxcvbn/case_helpers.rbs
 - sig/zxcvbn/clock.rbs
 - sig/zxcvbn/crack_time.rbs
 - sig/zxcvbn/data.rbs
@@ -93,9 +95,9 @@ metadata:
   allowed_push_host: https://rubygems.org
   bug_tracker_uri: https://github.com/envato/zxcvbn-ruby/issues
   changelog_uri: https://github.com/envato/zxcvbn-ruby/blob/HEAD/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/zxcvbn-ruby/2.0.0
+  documentation_uri: https://www.rubydoc.info/gems/zxcvbn-ruby/2.0.1
   homepage_uri: https://github.com/envato/zxcvbn-ruby
-  source_code_uri: https://github.com/envato/zxcvbn-ruby/tree/v2.0.0
+  source_code_uri: https://github.com/envato/zxcvbn-ruby/tree/v2.0.1
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -111,7 +113,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.12
+rubygems_version: 4.0.15
 specification_version: 4
 summary: Ruby port of Dropbox's zxcvbn.js JavaScript password strength estimator
 test_files: []