CVE-2023-0569 (Ruby, published 2023-01-29T17:15Z)
Description: value: Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/publify/publify
Files changed:
publify_core/app/models/user.rb
publify_core/lib/publify_core.rb
publify_core/lib/publify_core/testing_support/factories.rb
publify_core/publify_core.gemspec
publify_core/spec/controllers/admin/users_controller_spec.rb
publify_core/spec/controllers/setup_controller_spec.rb
publify_core/spec/features/login_spec.rb
publify_core/spec/features/reset_password_spec.rb
publify_core/spec/features/setup_spec.rb
publify_core/spec/features/signup_spec.rb
publify_core/spec/models/user_spec.rb
Commit message: Require user passwords to be strong

This adds validation of passwords using the zxcvbn password strength
estimation gem.


Vulnerable code:
         :recoverable, :rememberable, :trackable, :validatable
    password { "top-secret" }
                                      password: "testpass",
                                      password_confirmation: "testpass",
                                      email: "corey@test.com", password: "testpass",
                                      password_confirmation: "testpass" } }
                                             password: "foo123bar" } }
                                             password: "foobar123" } }
                                             password: "foobar123" } }
    create :user, :as_admin, login: "admin", password: "a-secret"
    fill_in :user_password, with: "a-secret"
    create :user, :as_admin, login: "admin", password: "forget-me"
    fill_in :user_password, with: "a-secret"
    fill_in :user_password_confirmation, with: "a-secret"
    fill_in :setting_password, with: "test1234"
    fill_in :user_password, with: "test1234"
    create :user, :as_admin, login: "admin", password: "a-secret"
    fill_in :user_password, with: "hush-hush"
    fill_in :user_password_confirmation, with: "hush-hush"
    fill_in :user_password, with: "hush-hush"

Fixed code:
         :recoverable, :rememberable, :trackable, :validatable, :zxcvbnable
require "devise_zxcvbn"
    password { "top-Secret12!$#" }
  s.add_dependency "devise_zxcvbn", "~> 6.0"
  let(:strong_password) { "fhnehnhfiiuh" }
                                      password: strong_password,
                                      password_confirmation: strong_password,
                                      email: "corey@test.com",
                                      password: strong_password,
                                      password_confirmation: strong_password } }
  let(:strong_password) { "fhnehnhfiiuh" }

                                             password: strong_password } }
                                             password: strong_password } }
                                             password: strong_password } }

        it "weak password should raise an error" do
          post :create, params: { setting: { blog_name: "Foo", email: "foo@bar.net",
                                             password: "foo123bar" } }
          expect(response).to redirect_to(action: "index")
        end
  let(:strong_password) { "fhnehnhfiiuh" }

    create :user, :as_admin, login: "admin", password: strong_password
    fill_in :user_password, with: strong_password
    create :user, :as_admin, login: "admin", password: "Fo_rgEt-1m5e2"
    fill_in :user_password, with: "a5-SeCre1T4"
    fill_in :user_password_confirmation, with: "a5-SeCre1T4"
  let(:strong_password) { "fhnehnhfiiuh" }

    fill_in :setting_password, with: strong_password
    fill_in :user_password, with: strong_password
  let(:strong_password) { "whhefwhfwefhiu" }

    create :user, :as_admin, login: "admin"
    fill_in :user_password, with: strong_password
    fill_in :user_password_confirmation, with: strong_password
    fill_in :user_password, with: strong_password

    it "requires a strong password" do
      nearly_valid_user = build(:user)
      expect(nearly_valid_user).not_to allow_value("password01").for(:password)
    end