Skip to content

Avoid bogus cred scanning hits #61070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stephentoub merged 2 commits into from
Nov 2, 2021
Merged

Avoid bogus cred scanning hits #61070

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
16583d5
Remove quasi passwords
danmoseley Nov 1, 2021
40e0738
oops
danmoseley Nov 1, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 26 additions & 26 deletions src/libraries/System.Text.RegularExpressions/tests/RegexExperiment.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,9 +346,9 @@ public void PasswordSearch()
string length = "[!-~]{8,12}";

// Just to make the chance that the randomly generated part actually has a match
// be astronomically unlikely require 'P' and 'r' to be present also,
// be astronomically unlikely require 'X' and 'r' to be present also,
// although this constraint is really bogus from password constraints point of view
string contains_first_P_and_then_r = ".*P.*r.*";
string contains_first_P_and_then_r = ".*X.*r.*";

// Conjunction of all the above constraints
string all = And(twoLower, twoUpper, threeDigits, oneSpecial, Not_countUp, Not_countDown, length, contains_first_P_and_then_r);
Expand All @@ -357,13 +357,13 @@ public void PasswordSearch()
Regex re = new Regex($@"\b{all}\b", RegexHelpers.RegexOptionNonBacktracking | RegexOptions.Singleline);

// Does not qualify because of 123 and connot end between 2 and 3 because of \b
string almostPassw1 = "P@ssW0rd123";
string almost1 = "X@ssW0rd123";
// Does not have at least two uppercase
string almostPassw2 = "P@55w0rd";
string almost2 = "X@55w0rd";

// These two qualify
string password1 = "P@55W0rd";
string password2 = "Pa5$w00rD";
string matching1 = "X@55W0rd";
string matching2 = "Xa5$w00rD";

foreach (int k in new int[] { 500, 1000, 5000, 10000, 50000, 100000 })
{
Expand All @@ -378,13 +378,13 @@ public void PasswordSearch()
string part2 = new string(Array.ConvertAll(buffer2, b => (char)b));
string part3 = new string(Array.ConvertAll(buffer3, b => (char)b));

string input = $"{part1} {almostPassw1} {part2} {password1} {part3} {password2}, finally this {almostPassw2} does not qualify either";
string input = $"{part1} {almost1} {part2} {matching1} {part3} {matching2}, finally this {almost2} does not qualify either";

int expextedMatch1Index = (2 * k) + almostPassw1.Length + 3;
int expextedMatch1Length = password1.Length;
int expextedMatch1Index = (2 * k) + almost1.Length + 3;
int expextedMatch1Length = matching1.Length;

int expextedMatch2Index = (3 * k) + almostPassw1.Length + password1.Length + 5;
int expextedMatch2Length = password2.Length;
int expextedMatch2Index = (3 * k) + almost1.Length + matching1.Length + 5;
int expextedMatch2Length = matching2.Length;

// Random text hiding almostPassw and password
int t = System.Environment.TickCount;
Expand All @@ -398,12 +398,12 @@ public void PasswordSearch()
Assert.True(match1.Success);
Assert.Equal(expextedMatch1Index, match1.Index);
Assert.Equal(expextedMatch1Length, match1.Length);
Assert.Equal(password1, match1.Value);
Assert.Equal(matching1, match1.Value);

Assert.True(match2.Success);
Assert.Equal(expextedMatch2Index, match2.Index);
Assert.Equal(expextedMatch2Length, match2.Length);
Assert.Equal(password2, match2.Value);
Assert.Equal(matching2, match2.Value);

Assert.False(match3.Success);
}
Expand Down Expand Up @@ -432,7 +432,7 @@ public void PasswordSearchDual()
// Just to make the chance that the randomly generated part actually has a match
// be astronomically unlikely require 'P' and 'r' to be present also,
// although this constraint is really bogus from password constraints point of view
string Not_contains_first_P_and_then_r = Not(".*P.*r.*");
string Not_contains_first_P_and_then_r = Not(".*X.*r.*");

// Negated disjunction of all the above constraints
// By deMorgan's laws we know that ~(A|B|...|C) = ~A&~B&...&~C and ~~A = A
Expand All @@ -443,13 +443,13 @@ public void PasswordSearchDual()
Regex re = new Regex($@"\b{all}\b", RegexHelpers.RegexOptionNonBacktracking | RegexOptions.Singleline);

// Does not qualify because of 123 and connot end between 2 and 3 because of \b
string almostPassw1 = "P@ssW0rd123";
string almost1 = "X@ssW0rd123";
// Does not have at least two uppercase
string almostPassw2 = "P@55w0rd";
string almost2 = "X@55w0rd";

// These two qualify
string password1 = "P@55W0rd";
string password2 = "Pa5$w00rD";
string matching1 = "X@55W0rd";
string matching2 = "Xa5$w00rD";

foreach (int k in new int[] { 500, 1000, 5000, 10000, 50000, 100000 })
{
Expand All @@ -464,15 +464,15 @@ public void PasswordSearchDual()
string part2 = new string(Array.ConvertAll(buffer2, b => (char)b));
string part3 = new string(Array.ConvertAll(buffer3, b => (char)b));

string input = $"{part1} {almostPassw1} {part2} {password1} {part3} {password2}, finally this {almostPassw2} does not qualify either";
string input = $"{part1} {almost1} {part2} {matching1} {part3} {matching2}, finally this {almost2} does not qualify either";

int expectedMatch1Index = (2 * k) + almostPassw1.Length + 3;
int expectedMatch1Length = password1.Length;
int expectedMatch1Index = (2 * k) + almost1.Length + 3;
int expectedMatch1Length = matching1.Length;

int expectedMatch2Index = (3 * k) + almostPassw1.Length + password1.Length + 5;
int expectedMatch2Length = password2.Length;
int expectedMatch2Index = (3 * k) + almost1.Length + matching1.Length + 5;
int expectedMatch2Length = matching2.Length;

// Random text hiding almostPassw and password
// Random text hiding almost and matching strings
int t = System.Environment.TickCount;
Match match1 = re.Match(input);
Match match2 = match1.NextMatch();
Expand All @@ -484,12 +484,12 @@ public void PasswordSearchDual()
Assert.True(match1.Success);
Assert.Equal(expectedMatch1Index, match1.Index);
Assert.Equal(expectedMatch1Length, match1.Length);
Assert.Equal(password1, match1.Value);
Assert.Equal(matching1, match1.Value);

Assert.True(match2.Success);
Assert.Equal(expectedMatch2Index, match2.Index);
Assert.Equal(expectedMatch2Length, match2.Length);
Assert.Equal(password2, match2.Value);
Assert.Equal(matching2, match2.Value);

Assert.False(match3.Success);
}
Expand Down