zxcvbn 0.1.8 → 0.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa46dde2a5eb2757753576eb8ff1fb74d7bdb3012dc91c6c9cfd7bc70ca91675
-  data.tar.gz: 3cf3b2e04f76138324548ea35ac3291833cb159b520b207a846cdab5e1a50e7b
+  metadata.gz: 2c519c7ba0712720763e56d09f829f3e23a1c7deb0684380da425613185d1916
+  data.tar.gz: dbd22f8b2d540d61e78db3e0be2eab4637dddb4b8bc585be3c4e78a64b56ed05
 SHA512:
-  metadata.gz: 06a251cda230ac1992543b624d64f8b3b8d33bdf9f579deb9bce8d94da65de3f4625330d14c98aa1587d3ccce08cd2998e3f9302c1cfcf9acff6ecc5883fe8d0
-  data.tar.gz: 884c32486ad5332b429939fa8180c49fb1d381b36d4ae0b69518d223642a2fa48af595bf8efe11568ff416e44a555ac5ee4854349b25623876bb61b02112b78a
+  metadata.gz: 5e75faed712c76af15e06520f2606d94b9b65c319d02e5833a89d669b771f74061f986c88ad0ddcb8c78dca5f0298ae681155bad24f249df7c257f0bf3a18c27
+  data.tar.gz: cfad539afdfd6bf16a0d541a87cbbbf56f77212e4b89d8e676ead50d97b6058e2bcac2081092095594795823971149330ca49cd5aae94b43f4efff1b0e63adce

data/CHANGELOG.md

@@ -1,11 +1,19 @@
+## [0.1.10] - 2023-10-15
+- [#10] Refactor implementation to avoid thread safety issues for user inputs
+
+  *Adam Kiczula (@adamkiczula)*
+
+## [0.1.9] - 2023-01-27
+- [#6] [#7] Security/Performance fix to vulnerability to DoS attacks.
+
 ## [0.1.8] - 2023-01-22
 - How to find information on translations on README.
 - Drop automatic tests on ruby 2.5 (It still works on it but development gems are failing to build).
 - Update dev gems to prepare to test on Ruby 3.1 and 3.2. (mini_racer, rubocop and bundler)
-- Fix Style/RedundantStringEscape on frequency_lists.rb
-- Add automated tests for Ruby 3.1 and 3.2
-- Add MFA requirement on release
-- Trim non-production files from final gem
+- Fix Style/RedundantStringEscape on frequency_lists.rb.
+- Add automated tests for Ruby 3.1 and 3.2.
+- Add MFA requirement on release.
+- Trim non-production files from final gem.
 
 ## [0.1.7] - 2021-06-12
 - Ported original specs

data/README.md

@@ -5,7 +5,20 @@
 
 Ruby port of Dropbox's [zxcvbn.js](https://github.com/dropbox/zxcvbn) JavaScript library running completely in Ruby (no need to load execjs or libv8).
 
-The intention is to provide an option 100% Ruby solution with all the same features and same results (or as close to the original JS function as possible).
+### Goals:
+- Exact same results as [dropbox/zxcvbn.js (Version 4.4.2)](https://github.com/dropbox/zxcvbn). If **result compatibility** is found or made different a major version will be bumped so no one is caught off guard.
+- Parity of features to [dropbox/zxcvbn.js (Version 4.4.2)](https://github.com/dropbox/zxcvbn) interface.
+- 100% native Ruby solution: **No Javascript Runtime**.
+
+### Compatible with [zxcvbn-js](https://github.com/bitzesty/zxcvbn-js) and [zxcvbn-ruby](https://github.com/envato/zxcvbn-ruby)
+
+This gem include compatibility interfaces so it can be used as a drop-in substitution both of the most popular alternatives `zxcvbn-js` and `zxcvbn-ruby`). Besides `Zxcvbn.zxcvbn` you can just call `Zxcvbn.test` or use `Zxcvbn::Tester.new` the same way as you would if you were using any of them.
+
+|                                    | `zxcvbn-rb`            | `zxcvbn-js`            | `zxcvbn-ruby`          |
+|------------------------------------|------------------------|------------------------|------------------------|
+| Results match `zxcvbn.js (V4.4.2)` | :white_check_mark: yes | :white_check_mark: yes | :x: no                 |
+| Run without Javascript Runtime     | :white_check_mark: yes | :x: no                 | :white_check_mark: yes |
+| Interface compatibility with others| :white_check_mark: yes | :x: no                 | :x: no                 |
 
 ## Installation
 
@@ -71,10 +84,6 @@ Zxcvbn.zxcvbn("password")
 }
 ```
 
-### Compatible with `zxcvbn-js` and `zxcvbn-ruby`
-
-This gem include a compatible interface so it can be used as a drop-in substitution for `zxcvbn-js` or `zxcvbn-ruby`. You can just call `Zxcvbn.test` or use `Zxcvbn::Tester.new` the same way as you would if you were using `zxcvbn-js` or `zxcvbn-ruby`.
-
 ### Note about translations (i18n, gettext, etc...)
 Check the [wiki](https://github.com/formigarafa/zxcvbn-rb/wiki) for more details on how to handle translations.
 
@@ -86,7 +95,7 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/formigarafa/zxcvbn. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/zxcvbn/blob/master/CODE_OF_CONDUCT.md).
+Bug reports and pull requests are welcome on GitHub at https://github.com/formigarafa/zxcvbn-rb. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/formigarafa/zxcvbn-rb/blob/master/CODE_OF_CONDUCT.md).
 
 ## License
 
@@ -94,4 +103,4 @@ The gem is available as open source under the terms of the [MIT License](https:/
 
 ## Code of Conduct
 
-Everyone interacting in the Zxcvbn project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/zxcvbn/blob/master/CODE_OF_CONDUCT.md).
+Everyone interacting in the Zxcvbn project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/formigarafa/zxcvbn-rb/blob/master/CODE_OF_CONDUCT.md).

data/lib/zxcvbn/matching.rb

@@ -15,6 +15,10 @@ module Zxcvbn
       build_ranked_dict(lst)
     end
 
+    RANKED_DICTIONARIES_MAX_WORD_SIZE = RANKED_DICTIONARIES.transform_values do |word_scores|
+      word_scores.keys.max_by(&:size).size
+    end
+
     GRAPHS = {
       "qwerty" => ADJACENCY_GRAPHS["qwerty"],
       "dvorak" => ADJACENCY_GRAPHS["dvorak"],
@@ -124,59 +128,65 @@ module Zxcvbn
     # ------------------------------------------------------------------------------
     # omnimatch -- combine everything ----------------------------------------------
     # ------------------------------------------------------------------------------
-    def self.omnimatch(password)
+    def self.omnimatch(password, user_inputs = [])
+      user_dict = build_user_input_dictionary(user_inputs)
       matches = []
-      matchers = [
-        :dictionary_match,
-        :reverse_dictionary_match,
-        :l33t_match,
-        :spatial_match,
-        :repeat_match,
-        :sequence_match,
-        :regex_match,
-        :date_match
-      ]
-      matchers.each do |matcher|
-        matches += send(matcher, password)
-      end
+      matches += dictionary_match(password, user_dict, _ranked_dictionaries = RANKED_DICTIONARIES)
+      matches += reverse_dictionary_match(password, user_dict, _ranked_dictionaries = RANKED_DICTIONARIES)
+      matches += l33t_match(password, user_dict, _ranked_dictionaries = RANKED_DICTIONARIES, _l33t_table = L33T_TABLE)
+      matches += spatial_match(password, _graphs = GRAPHS)
+      matches += repeat_match(password, user_dict)
+      matches += sequence_match(password)
+      matches += regex_match(password, _regexen = REGEXEN)
+      matches += date_match(password)
       sorted(matches)
     end
 
     #-------------------------------------------------------------------------------
     # dictionary match (common passwords, english, last names, etc) ----------------
     #-------------------------------------------------------------------------------
-    def self.dictionary_match(password, _ranked_dictionaries = RANKED_DICTIONARIES)
+    def self.dictionary_match(password, user_dict, _ranked_dictionaries = RANKED_DICTIONARIES)
       # _ranked_dictionaries variable is for unit testing purposes
       matches = []
+      _ranked_dictionaries.each do |dictionary_name, ranked_dict|
+        check_dictionary(matches, password, dictionary_name, ranked_dict)
+      end
+      check_dictionary(matches, password, "user_inputs", user_dict)
+      sorted(matches)
+    end
+
+    def self.check_dictionary(matches, password, dictionary_name, ranked_dict)
       len = password.length
       password_lower = password.downcase
-      _ranked_dictionaries.each do |dictionary_name, ranked_dict|
-        (0...len).each do |i|
-          (i...len).each do |j|
-            if ranked_dict.key?(password_lower[i..j])
-              word = password_lower[i..j]
-              rank = ranked_dict[word]
-              matches << {
-                "pattern" => "dictionary",
-                "i" => i,
-                "j" => j,
-                "token" => password[i..j],
-                "matched_word" => word,
-                "rank" => rank,
-                "dictionary_name" => dictionary_name,
-                "reversed" => false,
-                "l33t" => false
-              }
-            end
+      longest_word_size = RANKED_DICTIONARIES_MAX_WORD_SIZE.fetch(dictionary_name) do
+        ranked_dict.keys.max_by(&:size)&.size || 0
+      end
+      search_width = [longest_word_size, len].min
+      (0...len).each do |i|
+        search_end = [i + search_width, len].min
+        (i...search_end).each do |j|
+          if ranked_dict.key?(password_lower[i..j])
+            word = password_lower[i..j]
+            rank = ranked_dict[word]
+            matches << {
+              "pattern" => "dictionary",
+              "i" => i,
+              "j" => j,
+              "token" => password[i..j],
+              "matched_word" => word,
+              "rank" => rank,
+              "dictionary_name" => dictionary_name,
+              "reversed" => false,
+              "l33t" => false
+            }
           end
         end
       end
-      sorted(matches)
     end
 
-    def self.reverse_dictionary_match(password, _ranked_dictionaries = RANKED_DICTIONARIES)
+    def self.reverse_dictionary_match(password, user_dict, _ranked_dictionaries = RANKED_DICTIONARIES)
       reversed_password = password.reverse
-      matches = dictionary_match(reversed_password, _ranked_dictionaries)
+      matches = dictionary_match(reversed_password, user_dict, _ranked_dictionaries)
       matches.each do |match|
         match["token"] = match["token"].reverse
         match["reversed"] = true
@@ -186,8 +196,15 @@ module Zxcvbn
       sorted(matches)
     end
 
-    def self.user_input_dictionary=(ordered_list)
-      RANKED_DICTIONARIES["user_inputs"] = build_ranked_dict(ordered_list.dup)
+    def self.build_user_input_dictionary(user_inputs_or_dict)
+      # optimization: if we receive a hash, we've been given the dict back (from the repeat matcher)
+      return user_inputs_or_dict if user_inputs_or_dict.is_a?(Hash)
+
+      sanitized_inputs = []
+      user_inputs_or_dict.each do |arg|
+        sanitized_inputs << arg.to_s.downcase if arg.is_a?(String) || arg.is_a?(Numeric) || arg == true || arg == false
+      end
+      build_ranked_dict(sanitized_inputs)
     end
 
     #-------------------------------------------------------------------------------
@@ -276,13 +293,13 @@ module Zxcvbn
       sub_dicts
     end
 
-    def self.l33t_match(password, _ranked_dictionaries = RANKED_DICTIONARIES, _l33t_table = L33T_TABLE)
+    def self.l33t_match(password, user_dict, _ranked_dictionaries = RANKED_DICTIONARIES, _l33t_table = L33T_TABLE)
       matches = []
       enumerate_l33t_subs(relevant_l33t_subtable(password, _l33t_table)).each do |sub|
         break if sub.empty? # corner case: password has no relevant subs.
 
         subbed_password = translate(password, sub)
-        dictionary_match(subbed_password, _ranked_dictionaries).each do |match|
+        dictionary_match(subbed_password, user_dict, _ranked_dictionaries).each do |match|
           token = password[match["i"]..match["j"]]
           if token.downcase == match["matched_word"]
             next # only return the matches that contain an actual substitution
@@ -392,7 +409,7 @@ module Zxcvbn
     #-------------------------------------------------------------------------------
     # repeats (aaa, abcabcabc) and sequences (abcdef) ------------------------------
     #-------------------------------------------------------------------------------
-    def self.repeat_match(password)
+    def self.repeat_match(password, user_dict)
       matches = []
       greedy = /(.+)\1+/
       lazy = /(.+?)\1+/
@@ -425,7 +442,7 @@ module Zxcvbn
         i = match.begin(0)
         j = match.end(0) - 1
         # recursively match and score the base string
-        base_analysis = Scoring.most_guessable_match_sequence(base_token, omnimatch(base_token))
+        base_analysis = Scoring.most_guessable_match_sequence(base_token, omnimatch(base_token, user_dict))
         base_matches = base_analysis["sequence"]
         base_guesses = base_analysis["guesses"]
         matches << {

data/lib/zxcvbn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Zxcvbn
-  VERSION = "0.1.8"
+  VERSION = "0.1.10"
 end

data/lib/zxcvbn.rb

@@ -13,13 +13,7 @@ module Zxcvbn
 
   def self.zxcvbn(password, user_inputs = [])
     start = (Time.now.to_f * 1000).to_i
-    # reset the user inputs matcher on a per-request basis to keep things stateless
-    sanitized_inputs = []
-    user_inputs.each do |arg|
-      sanitized_inputs << arg.to_s.downcase if arg.is_a?(String) || arg.is_a?(Numeric) || arg == true || arg == false
-    end
-    Matching.user_input_dictionary = sanitized_inputs
-    matches = Matching.omnimatch(password)
+    matches = Matching.omnimatch(password, user_inputs)
     result = Scoring.most_guessable_match_sequence(password, matches)
     result["calc_time"] = (Time.now.to_f * 1000).to_i - start
     attack_times = TimeEstimates.estimate_attack_times(result["guesses"])

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zxcvbn
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.1.10
 platform: ruby
 authors:
 - Rafael Santos
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-01-22 00:00:00.000000000 Z
+date: 2023-10-15 00:00:00.000000000 Z
 dependencies: []
 description: 100% native Ruby 100% compatible port of Dropbox's zxcvbn.js
 email:
@@ -52,7 +52,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: ''