add code fix for weakPassword

data/static/challenges.yml

@@ -611,6 +611,7 @@
  tags:
  - Brute Force
  - Tutorial
+ - Code Analysis
  description: 'Log in with the administrator''s user credentials without previously changing them or applying SQL Injection.'
  difficulty: 2
  hint: 'This one should be equally easy to a) brute force, b) crack the password hash or c) simply guess.'

data/static/codefixes/weakPasswordChallenge.info.yml

@@ -0,0 +1,12 @@
+fixes:
+ - id: 1
+ explanation: "According to NIST-800-63B, passwords (Memorized Secrets) should be at least eight characters to prevent 'online attacks'. Furthermore, NIST-800-63B requires that passwords don't appear in common dictionaries.
+If you want to have more fun with secrets, check out OWASP Wrong Secrets at https://wrongsecrets.fly.dev/, specially challenge 16 and 23."
+ - id: 2
+ explanation: "According to NIST-800-63B, passwords (Memorized Secrets) should be at least eight characters to prevent 'online attacks'. Usage of special character tests is not appropriate (anymore) because users tend to find known workarounds like notes with passwords or adding an exclamation mark at the end to add a special character."
+ - id: 3
+ explanation: "According to NIST-800-63B, passwords (Memorized Secrets) should be at least eight characters to prevent 'online attacks'. Usage of special character tests is not appropriate (anymore) because users tend to find known workarounds like notes with passwords or adding an exclamation mark at the end to add a special character."
+ - id: 4
+ explanation: "According to NIST-800-63B passwords (Memorized Secrets) should be at least 8 characters to prevent 'online attacks'."
+hints:
+ - "NIST Special Publication 800-63B has changed the recommendation for passwords (Memorized Secrets) requirements in 2017."

data/static/codefixes/weakPasswordChallenge_1_correct.ts

@@ -0,0 +1,16 @@
+export class LoginComponent implements OnInit {
+ public emailControl = new UntypedFormControl('', [Validators.required])
+
+ public passwordControl = new UntypedFormControl('', [
+ Validators.required,
+ Validators.minLength(8),
+ validatePasswordIsNotInTopOneMillionCommonPasswordsList()
+ ])
+
+ public hide = true
+ public user: any
+ public rememberMe: UntypedFormControl = new UntypedFormControl(false)
+ public error: any
+ public clientId = '1005568560502-6hm16lef8oh46hr2d98vf2ohlnj4nfhq.apps.googleusercontent.com'
+ public oauthUnavailable: boolean = true
+ public redirectUri: string = ''

data/static/codefixes/weakPasswordChallenge_2.ts

@@ -0,0 +1,19 @@
+export class LoginComponent implements OnInit {
+ public emailControl = new UntypedFormControl('', [Validators.required])
+
+ public passwordControl = new UntypedFormControl('', [
+ Validators.required,
+ Validators.minLength(8),
+ validatePasswordHasAtLeastOneNumber(),
+ validatePasswordHasAtLeastOneSpecialChar(),
+ validatePasswordHasAtLeastOneUpperCaseChar(),
+ validatePasswordHasAtLeastOneLowerCaseChar(),
+ ])
+
+ public hide = true
+ public user: any
+ public rememberMe: UntypedFormControl = new UntypedFormControl(false)
+ public error: any
+ public clientId = '1005568560502-6hm16lef8oh46hr2d98vf2ohlnj4nfhq.apps.googleusercontent.com'
+ public oauthUnavailable: boolean = true
+ public redirectUri: string = ''

data/static/codefixes/weakPasswordChallenge_3.ts

@@ -0,0 +1,20 @@
+export class LoginComponent implements OnInit {
+ public emailControl = new UntypedFormControl('', [Validators.required])
+
+ public passwordControl = new UntypedFormControl('', [
+ Validators.required,
+ Validators.minLength(8),
+ validatePasswordHasAtLeastOneNumber(),
+ validatePasswordHasAtLeastOneSpecialChar(),
+ validatePasswordHasAtLeastOneUpperCaseChar(),
+ validatePasswordHasAtLeastOneLowerCaseChar(),
+ validatePasswordHasNoSpace(),
+ ])
+
+ public hide = true
+ public user: any
+ public rememberMe: UntypedFormControl = new UntypedFormControl(false)
+ public error: any
+ public clientId = '1005568560502-6hm16lef8oh46hr2d98vf2ohlnj4nfhq.apps.googleusercontent.com'
+ public oauthUnavailable: boolean = true
+ public redirectUri: string = ''

data/static/codefixes/weakPasswordChallenge_4.ts

@@ -0,0 +1,16 @@
+export class LoginComponent implements OnInit {
+ public emailControl = new UntypedFormControl('', [Validators.required])
+
+ public passwordControl = new UntypedFormControl('', [
+ Validators.required,
+ Validators.minLength(2),
+ validatePasswordIsNotInTopOneMillionCommonPasswordsList()
+ ])
+
+ public hide = true
+ public user: any
+ public rememberMe: UntypedFormControl = new UntypedFormControl(false)
+ public error: any
+ public clientId = '1005568560502-6hm16lef8oh46hr2d98vf2ohlnj4nfhq.apps.googleusercontent.com'
+ public oauthUnavailable: boolean = true
+ public redirectUri: string = ''

frontend/src/app/login/login.component.ts

@@ -26,16 +26,19 @@ const oauthProviderUrl = 'https://accounts.google.com/o/oauth2/v2/auth'
  templateUrl: './login.component.html',
  styleUrls: ['./login.component.scss']
 })
+// vuln-code-snippet start weakPasswordChallenge
 export class LoginComponent implements OnInit {
  public emailControl = new UntypedFormControl('', [Validators.required])
- public passwordControl = new UntypedFormControl('', [Validators.required])
+
+ public passwordControl = new UntypedFormControl('', [Validators.required, Validators.minLength(1)]) // vuln-code-snippet vuln-line weakPasswordChallenge
+
  public hide = true
  public user: any
  public rememberMe: UntypedFormControl = new UntypedFormControl(false)
  public error: any
  public clientId = '1005568560502-6hm16lef8oh46hr2d98vf2ohlnj4nfhq.apps.googleusercontent.com'
  public oauthUnavailable: boolean = true
- public redirectUri: string = ''
+ public redirectUri: string = '' // vuln-code-snippet end weakPasswordChallenge
  constructor (private readonly configurationService: ConfigurationService, private readonly userService: UserService, private readonly windowRefService: WindowRefService, private readonly cookieService: CookieService, private readonly router: Router, private readonly formSubmitService: FormSubmitService, private readonly basketService: BasketService, private readonly ngZone: NgZone) { }
 
  ngOnInit () {