CVE-2023-4125 (Go, published 2023-08-03T04:15Z)
Description: value: Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/answerdev/answer
Files changed:
i18n/en_US.yaml
i18n/zh_CN.yaml
internal/base/validator/validator.go
internal/migrations/v10.go
internal/schema/user_schema.go
pkg/checker/password.go
Commit message: fix(password): password can't contains space.


Vulnerable code:
#  backend.email.tpl.change_email.title.other = Confirm your new email address for {{.SiteName}}  by clicking on the following link:\u003cbr\u003e\u003cbr\u003e\n\n\u003ca href='{{.ChangeEmailUrl}}' target='_blank'\u003e{{.ChangeEmailUrl}}\u003c/a\u003e\u003cbr\u003e\u003cbr\u003e\n\nIf you did not request this change, please ignore this email.\n
#  backend.email.tpl.change_email.body.other = [{{.SiteName}}] Confirm your new email address
#  backend.email.tpl.new_answer.title.other = \u003cstrong\u003e\u003ca href='{{.AnswerUrl}}'\u003e{{.QuestionTitle}}\u003c/a\u003e\u003c/strong\u003e\u003cbr\u003e\u003cbr\u003e\n\n\u003csmall\u003e{{.DisplayName}}:\u003c/small\u003e\u003cbr\u003e\n\u003cblockquote\u003e{{.AnswerSummary}}\u003c/blockquote\u003e\u003cbr\u003e\n\u003ca href='{{.AnswerUrl}}'\u003eView it on {{.SiteName}}\u003c/a\u003e\u003cbr\u003e\u003cbr\u003e\n\n\u003csmall\u003eYou are receiving this because you authored the thread. \u003ca href='{{.UnsubscribeUrl}}'\u003eUnsubscribe\u003c/a\u003e\u003c/small\u003e
#  backend.email.tpl.new_answer.body.other = [{{.SiteName}}] {{.DisplayName}} answered your question
#  backend.email.tpl.new_comment.title.other = \u003cstrong\u003e\u003ca href='{{.CommentUrl}}'\u003e{{.QuestionTitle}}\u003c/a\u003e\u003c/strong\u003e\u003cbr\u003e\u003cbr\u003e\n\n\u003csmall\u003e{{.DisplayName}}:\u003c/small\u003e\u003cbr\u003e\n\u003cblockquote\u003e{{.CommentSummary}}\u003c/blockquote\u003e\u003cbr\u003e\n\u003ca href='{{.CommentUrl}}'\u003eView it on {{.SiteName}}\u003c/a\u003e\u003cbr\u003e\u003cbr\u003e\n\n\u003csmall\u003eYou are receiving this because you authored the thread. \u003ca href='{{.UnsubscribeUrl}}'\u003eUnsubscribe\u003c/a\u003e\u003c/small\u003e
#  backend.email.tpl.new_comment.body.other = [{{.SiteName}}] {{.DisplayName}} commented on your post
#  backend.email.tpl.pass_reset.title.other = Somebody asked to reset your password on [{{.SiteName}}].\u003cbr\u003e\u003cbr\u003e\n\nIf it was not you, you can safely ignore this email.\u003cbr\u003e\u003cbr\u003e\n\nClick the following link to choose a new password:\u003cbr\u003e\n\u003ca href='{{.PassResetUrl}}' target='_blank'\u003e{{.PassResetUrl}}\u003c/a\u003e\n
#  backend.email.tpl.pass_reset.body.other = [{{.SiteName }}] Password reset
#  backend.email.tpl.register.title.other = Welcome to {{.SiteName}}\u003cbr\u003e\u003cbr\u003e\n\nClick the following link to confirm and activate your new account:\u003cbr\u003e\n\u003ca href='{{.RegisterUrl}}' target='_blank'\u003e{{.RegisterUrl}}\u003c/a\u003e\u003cbr\u003e\u003cbr\u003e\n\nIf the above link is not clickable, try copying and pasting it into the address bar of your web browser.\n
#  backend.email.tpl.register.body.other = [{{.SiteName}}] Confirm your new account
#  backend.email.tpl.test.title.other = This is a test email.
#  backend.email.tpl.test.body.other = [{{.SiteName}}] Test Email



  email:
		return errFields, err
	// TODO i18n
	err = checker.CheckPassword(8, 32, 0, u.Pass)
	if err != nil {
		errField := &validator.FormErrorField{
		}
		errFields = append(errFields, errField)
	OldPass string `validate:"omitempty,gte=8,lte=32" json:"old_pass"`
	Pass    string `validate:"required,gte=8,lte=32" json:"pass"`
	// TODO i18n
	err = checker.CheckPassword(8, 32, 0, u.Pass)
	if err != nil {
		errField := &validator.FormErrorField{
		}
		errFields = append(errFields, errField)
	// TODO i18n
	err = checker.CheckPassword(8, 32, 0, u.Pass)
	if err != nil {
		errField := &validator.FormErrorField{
		}
		errFields = append(errFields, errField)
// CheckPassword
// minLength: Specifies the minimum length of a password
// maxLength：Specifies the maximum length of a password
// minLevel：Specifies the minimum strength level required for passwords
// pwd：Text passwords
func CheckPassword(minLength, maxLength, minLevel int, pwd string) error {
	// First check whether the password length is within the range
	if len(pwd) < minLength {
		return fmt.Errorf("BAD PASSWORD: The password is shorter than %d characters", minLength)
	}
	if len(pwd) > maxLength {
		return fmt.Errorf("BAD PASSWORD: The password is logner than %d characters", maxLength)
		match, _ := regexp.MatchString(pattern, pwd)

Fixed code:
    password:
      space_invalid:
        other: Password cannot contain spaces.
  e_mail:
    password:
      space_invalid:
        other: 密码不能包含空格。
		errMsg := ""
			errMsg = errField.ErrorMsg
		return errFields, myErrors.BadRequest(reason.RequestFormatError).WithMsg(errMsg)
		data, _ := json.Marshal(content)
		loginSiteInfo.Content = string(data)
	if err = checker.CheckPassword(u.Pass); err != nil {
		errFields = append(errFields, &validator.FormErrorField{
		})
	OldPass     string `validate:"omitempty,gte=8,lte=32" json:"old_pass"`
	Pass        string `validate:"required,gte=8,lte=32" json:"pass"`
	if err = checker.CheckPassword(u.Pass); err != nil {
		errFields = append(errFields, &validator.FormErrorField{
		})
	if err = checker.CheckPassword(u.Pass); err != nil {
		errFields = append(errFields, &validator.FormErrorField{
		})
	"strings"
const (
	PasswordCannotContainSpaces = "error.password.space_invalid"
)

// CheckPassword checks the password strength
func CheckPassword(password string) error {
	if strings.Contains(password, " ") {
		return fmt.Errorf(PasswordCannotContainSpaces)
	// TODO Currently there is no requirement for password strength
	minLevel := 0

		match, _ := regexp.MatchString(pattern, password)