zxcvbn 0.1.8 → 0.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa46dde2a5eb2757753576eb8ff1fb74d7bdb3012dc91c6c9cfd7bc70ca91675
-  data.tar.gz: 3cf3b2e04f76138324548ea35ac3291833cb159b520b207a846cdab5e1a50e7b
+  metadata.gz: 6a374558176fa132c830032ab3cf333483389b98ce54ef92bfd026400362a224
+  data.tar.gz: eb751fc63e94b4573144f66ef9cc343695104cd4461fd170931b5b5fa06e0ad2
 SHA512:
-  metadata.gz: 06a251cda230ac1992543b624d64f8b3b8d33bdf9f579deb9bce8d94da65de3f4625330d14c98aa1587d3ccce08cd2998e3f9302c1cfcf9acff6ecc5883fe8d0
-  data.tar.gz: 884c32486ad5332b429939fa8180c49fb1d381b36d4ae0b69518d223642a2fa48af595bf8efe11568ff416e44a555ac5ee4854349b25623876bb61b02112b78a
+  metadata.gz: e50119ccf438121beee719afe200c7a2085c0a266f5c5595fb95bebc01a10fca980dec4df8a30374dc5f7cf7bb5c57708a7f71565877ee8885d6740e54e71d66
+  data.tar.gz: 1323dff6d9433298bc44c4a2632de42af7137629d02113e60f2a64f6d184967a27a13e161ff3d2404b6a58177d880465bd865cc4d95158bd33c07849ed0361f4

data/CHANGELOG.md

@@ -1,11 +1,14 @@
+## [0.1.9] - 2023-01-27
+- [#6] [#7] Security/Performance fix to vulnerability to DoS attacks.
+
 ## [0.1.8] - 2023-01-22
 - How to find information on translations on README.
 - Drop automatic tests on ruby 2.5 (It still works on it but development gems are failing to build).
 - Update dev gems to prepare to test on Ruby 3.1 and 3.2. (mini_racer, rubocop and bundler)
-- Fix Style/RedundantStringEscape on frequency_lists.rb
-- Add automated tests for Ruby 3.1 and 3.2
-- Add MFA requirement on release
-- Trim non-production files from final gem
+- Fix Style/RedundantStringEscape on frequency_lists.rb.
+- Add automated tests for Ruby 3.1 and 3.2.
+- Add MFA requirement on release.
+- Trim non-production files from final gem.
 
 ## [0.1.7] - 2021-06-12
 - Ported original specs

data/README.md

@@ -5,7 +5,20 @@
 
 Ruby port of Dropbox's [zxcvbn.js](https://github.com/dropbox/zxcvbn) JavaScript library running completely in Ruby (no need to load execjs or libv8).
 
-The intention is to provide an option 100% Ruby solution with all the same features and same results (or as close to the original JS function as possible).
+### Goals:
+- Exact same results as [dropbox/zxcvbn.js (Version 4.4.2)](https://github.com/dropbox/zxcvbn). If **result compatibility** is found or made different a major version will be bumped so no one is caught off guard.
+- Parity of features to [dropbox/zxcvbn.js (Version 4.4.2)](https://github.com/dropbox/zxcvbn) interface.
+- 100% native Ruby solution: **No Javascript Runtime**.
+
+### Compatible with [zxcvbn-js](https://github.com/bitzesty/zxcvbn-js) and [zxcvbn-ruby](https://github.com/envato/zxcvbn-ruby)
+
+This gem include compatibility interfaces so it can be used as a drop-in substitution both of the most popular alternatives `zxcvbn-js` and `zxcvbn-ruby`). Besides `Zxcvbn.zxcvbn` you can just call `Zxcvbn.test` or use `Zxcvbn::Tester.new` the same way as you would if you were using any of them.
+
+|                                    | `zxcvbn-rb`            | `zxcvbn-js`            | `zxcvbn-ruby`          |
+|------------------------------------|------------------------|------------------------|------------------------|
+| Results match `zxcvbn.js (V4.4.2)` | :white_check_mark: yes | :white_check_mark: yes | :x: no                 |
+| Run without Javascript Runtime     | :white_check_mark: yes | :x: no                 | :white_check_mark: yes |
+| Interface compatibility with others| :white_check_mark: yes | :x: no                 | :x: no                 |
 
 ## Installation
 
@@ -71,10 +84,6 @@ Zxcvbn.zxcvbn("password")
 }
 ```
 
-### Compatible with `zxcvbn-js` and `zxcvbn-ruby`
-
-This gem include a compatible interface so it can be used as a drop-in substitution for `zxcvbn-js` or `zxcvbn-ruby`. You can just call `Zxcvbn.test` or use `Zxcvbn::Tester.new` the same way as you would if you were using `zxcvbn-js` or `zxcvbn-ruby`.
-
 ### Note about translations (i18n, gettext, etc...)
 Check the [wiki](https://github.com/formigarafa/zxcvbn-rb/wiki) for more details on how to handle translations.
 

data/lib/zxcvbn/matching.rb

@@ -15,6 +15,10 @@ module Zxcvbn
       build_ranked_dict(lst)
     end
 
+    RANKED_DICTIONARIES_MAX_WORD_SIZE = RANKED_DICTIONARIES.transform_values do |word_scores|
+      word_scores.keys.max_by(&:size).size
+    end
+
     GRAPHS = {
       "qwerty" => ADJACENCY_GRAPHS["qwerty"],
       "dvorak" => ADJACENCY_GRAPHS["dvorak"],
@@ -151,8 +155,13 @@ module Zxcvbn
       len = password.length
       password_lower = password.downcase
       _ranked_dictionaries.each do |dictionary_name, ranked_dict|
+        longest_dict_word_size = RANKED_DICTIONARIES_MAX_WORD_SIZE.fetch(dictionary_name) do
+          ranked_dict.keys.max_by(&:size)&.size || 0
+        end
+        search_width = [longest_dict_word_size, len].min
         (0...len).each do |i|
-          (i...len).each do |j|
+          search_end = [i + search_width, len].min
+          (i...search_end).each do |j|
             if ranked_dict.key?(password_lower[i..j])
               word = password_lower[i..j]
               rank = ranked_dict[word]
@@ -187,7 +196,9 @@ module Zxcvbn
     end
 
     def self.user_input_dictionary=(ordered_list)
-      RANKED_DICTIONARIES["user_inputs"] = build_ranked_dict(ordered_list.dup)
+      ranked_dict = build_ranked_dict(ordered_list.dup)
+      RANKED_DICTIONARIES["user_inputs"] = ranked_dict
+      RANKED_DICTIONARIES_MAX_WORD_SIZE["user_inputs"] = ranked_dict.keys.max_by(&:size)&.size || 0
     end
 
     #-------------------------------------------------------------------------------

data/lib/zxcvbn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Zxcvbn
-  VERSION = "0.1.8"
+  VERSION = "0.1.9"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zxcvbn
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.1.9
 platform: ruby
 authors:
 - Rafael Santos
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-01-22 00:00:00.000000000 Z
+date: 2023-01-27 00:00:00.000000000 Z
 dependencies: []
 description: 100% native Ruby 100% compatible port of Dropbox's zxcvbn.js
 email: