Repository: mlflow/mlflow
Pull request: Validate auth password to be string longer than 12 chars
<details><summary>&#x1F6E0 DevTools &#x1F6E0</summary>
<p>

[![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/WeichenXu123/mlflow/pull/15287?quickstart=1)

#### Install mlflow from this PR

```
# mlflow
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/15287/merge
# mlflow-skinny
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/15287/merge#subdirectory=skinny
```

For Databricks, use the following command:

```
%sh curl -LsSf https://raw.githubusercontent.com/mlflow/mlflow/HEAD/dev/install-skinny.sh | sh -s 15287
```

</p>
</details>

### Related Issues/PRs

<!-- Uncomment 'Resolve' if this PR can close the linked items. -->
<!-- Resolve --> closes #15276

### What changes are proposed in this pull request?

<!-- Please fill in changes proposed in this PR. -->
Validate auth password to be string longer than 8 chars

### How is this PR tested?

- [ ] Existing unit/integration tests
- [ ] New unit/integration tests
- [x] Manual tests

<!-- Attach code, screenshot, video used for manual testing here. -->

### Does this PR require documentation update?

- [x] No. You can skip the rest of this section.
- [ ] Yes. I've updated:
  - [ ] Examples
  - [ ] API references
  - [ ] Instructions

### Release Notes

#### Is this a user-facing change?

- [ ] No. You can skip the rest of this section.
- [x] Yes. Give a description of this change to be included in the release notes for MLflow users.

<!-- Details in 1-2 sentences. You can just refer to another PR with a description if this PR is part of a larger change. -->
Validate auth password to be string longer than 8 chars

#### What component(s), interfaces, languages, and integrations does this PR affect?

Components

- [ ] `area/artifacts`: Artifact stores and artifact logging
- [ ] `area/build`: Build and test infrastructure for MLflow
- [ ] `area/deployments`: MLflow Deployments client APIs, server, and third-party Deployments integrations
- [ ] `area/docs`: MLflow documentation pages
- [ ] `area/examples`: Example code
- [ ] `area/model-registry`: Model Registry service, APIs, and the fluent client calls for Model Registry
- [ ] `area/models`: MLmodel format, model serialization/deserialization, flavors
- [ ] `area/recipes`: Recipes, Recipe APIs, Recipe configs, Recipe Templates
- [ ] `area/projects`: MLproject format, project running backends
- [ ] `area/scoring`: MLflow Model server, model deployment tools, Spark UDFs
- [x] `area/server-infra`: MLflow Tracking server backend
- [ ] `area/tracking`: Tracking Service, tracking client APIs, autologging

Interface

- [ ] `area/uiux`: Front-end, user experience, plotting, JavaScript, JavaScript dev server
- [ ] `area/docker`: Docker use across MLflow's components, such as MLflow Projects and MLflow Models
- [ ] `area/sqlalchemy`: Use of SQLAlchemy in the Tracking Service or Model Registry
- [ ] `area/windows`: Windows support

Language

- [ ] `language/r`: R APIs and clients
- [ ] `language/java`: Java APIs and clients
- [ ] `language/new`: Proposals for new client languages

Integrations

- [ ] `integrations/azure`: Azure and Azure ML integrations
- [ ] `integrations/sagemaker`: SageMaker integrations
- [ ] `integrations/databricks`: Databricks integrations

<!--
Insert an empty named anchor here to allow jumping to this section with a fragment URL
(e.g. https://github.com/mlflow/mlflow/pull/123#user-content-release-note-category).
Note that GitHub prefixes anchor names in markdown with "user-content-".
-->

<a name="release-note-category"></a>

#### How should the PR be classified in the release notes? Choose one:

- [ ] `rn/none` - No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" section
- [ ] `rn/breaking-change` - The PR will be mentioned in the "Breaking Changes" section
- [ ] `rn/feature` - A new user-facing feature worth mentioning in the release notes
- [x] `rn/bug-fix` - A user-facing bug fix worth mentioning in the release notes
- [ ] `rn/documentation` - A user-facing documentation change worth mentioning in the release notes

#### Should this PR be included in the next patch release?

`Yes` should be selected for bug fixes, documentation updates, and other small changes. `No` should be selected for new features and larger changes. If you're unsure about the release classification of this PR, leave this unchecked to let the maintainers decide.

<details>
<summary>What is a minor/patch release?</summary>

- Minor release: a release that increments the second part of the version number (e.g., 1.2.0 -> 1.3.0).
  Bug fixes, doc updates and new features usually go into minor releases.
- Patch release: a release that increments the third part of the version number (e.g., 1.2.0 -> 1.2.1).
  Bug fixes and doc updates usually go into patch releases.

</details>

<!-- patch -->

- [x] Yes (this PR will be cherry-picked and included in the next patch release)
- [ ] No (this PR will be included in the next minor release)


Problem statement:
[BUG] Security Vulnerability
Hello,

Trend Micro's Zero Day Initiative is a security/vulnerability research organization. We have discovered a vulnerability in  MLflow  and we would like to disclose it responsibly to your company. Thank you and best regards,
Kholoud Altookhy
Program Manager, Zero Day Initiative
Trend Micro
[ZDI-DISCLOSURES@trendmicro.com](mailto:ZDI-DISCLOSURES@trendmicro.com)

Hints from issue discussion:
Hi @zdi-disclosures we have received your report and will be filing a fix for it this week. Thank you for identifying it! The fix will be in MLflow 2.22.0.

Commit message: update

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>

Patch to review:
diff --git a/mlflow/server/auth/__init__.py b/mlflow/server/auth/__init__.py
index deadfff164b6e..4609e766b364a 100644
--- a/mlflow/server/auth/__init__.py
+++ b/mlflow/server/auth/__init__.py
@@ -782,7 +782,7 @@ def signup():
   <br>
   <label for="password">Password:</label>
   <br>
-  <input type="password" id="password" name="password" minlength="4">
+  <input type="password" id="password" name="password" minlength="8">
   <br>
   <br>
   <input type="submit" value="Sign up">
diff --git a/mlflow/server/auth/sqlalchemy_store.py b/mlflow/server/auth/sqlalchemy_store.py
index c85337c9a8ebf..6e544e5abc5dc 100644
--- a/mlflow/server/auth/sqlalchemy_store.py
+++ b/mlflow/server/auth/sqlalchemy_store.py
@@ -20,7 +20,7 @@
 from mlflow.server.auth.permissions import _validate_permission
 from mlflow.store.db.utils import _get_managed_session_maker, create_sqlalchemy_engine_with_retry
 from mlflow.utils.uri import extract_db_type_from_uri
-from mlflow.utils.validation import _validate_username
+from mlflow.utils.validation import _validate_username, _validate_password
 
 
 class SqlAlchemyStore:
@@ -42,6 +42,7 @@ def authenticate_user(self, username: str, password: str) -> bool:
 
     def create_user(self, username: str, password: str, is_admin: bool = False) -> User:
         _validate_username(username)
+        _validate_password(password)
         pwhash = generate_password_hash(password)
         with self.ManagedSessionMaker() as session:
             try:
diff --git a/mlflow/utils/validation.py b/mlflow/utils/validation.py
index 28b97078d7a20..47c63ef3947ba 100644
--- a/mlflow/utils/validation.py
+++ b/mlflow/utils/validation.py
@@ -623,6 +623,11 @@ def _validate_username(username):
         raise MlflowException("Username cannot be empty.", INVALID_PARAMETER_VALUE)
 
 
+def _validate_password(password):
+    if password is None or len(password) < 8:
+        raise MlflowException("Password must be a string longer than 8 characters.")
+
+
 def _validate_trace_tag(key, value):
     _validate_tag_name(key)
     key = _validate_length_limit("key", MAX_TRACE_TAG_KEY_LENGTH, key)


Code review comments:
diff_hunk: @@ -623,6 +623,11 @@ def _validate_username(username):
         raise MlflowException("Username cannot be empty.", INVALID_PARAMETER_VALUE)
 
 
+def _validate_password(password):
+    if password is None or len(password) < 8:
+        raise MlflowException("Password must be a string longer than 8 characters.")
path: mlflow/utils/validation.py
text: @user1:
```suggestion
    if password is None or len(password) < 12:
        raise MlflowException("Password must be a string longer than 12 characters.")
```

diff_hunk: @@ -623,6 +623,11 @@ def _validate_username(username):
         raise MlflowException("Username cannot be empty.", INVALID_PARAMETER_VALUE)
 
 
+def _validate_password(password):
+    if password is None or len(password) < 8:
+        raise MlflowException("Password must be a string longer than 8 characters.")
path: mlflow/utils/validation.py
text: @user1:
```suggestion
        raise MlflowException.invalid_parameter_value("Password must be a string longer than 8 characters.")
```

diff_hunk: @@ -782,7 +782,7 @@ def signup():
   <br>
   <label for="password">Password:</label>
   <br>
-  <input type="password" id="password" name="password" minlength="4">
+  <input type="password" id="password" name="password" minlength="8">
path: mlflow/server/auth/__init__.py
text: @user1:
```suggestion
  <input type="password" id="password" name="password" minlength="12">
```

diff_hunk: @@ -623,6 +623,11 @@ def _validate_username(username):
         raise MlflowException("Username cannot be empty.", INVALID_PARAMETER_VALUE)
 
 
+def _validate_password(password):
path: mlflow/utils/validation.py
text: @user1:
Consider enhancing `_validate_password` to include checks for complexity, such as requiring at least one uppercase letter, one number, and one special character. For example:

```python
def _validate_password(password):
    if password is None or len(password) < 8:
        raise MlflowException("Password must be a string longer than 8 characters.")
    if not any(char.isdigit() for char in password):
        raise MlflowException("Password must include at least one number.")
    if not any(char.isupper() for char in password):
        raise MlflowException("Password must include at least one uppercase letter.")
    if not any(char in '!@#$%^&*()_+-=[]{}|;:,.<>?' for char in password):
        raise MlflowException("Password must include at least one special character.")
```

@user1:
This can be a follow-up.

@author:
we need to add similar validation logic in the front-end. we'd better create a follow-up PR for it, to avoid blocking the urgent fix.

@user2:
does the frontend not currently propagate the error from the backend? if not we should include that in the follow up

@author:
> does the frontend not currently propagate the error from the backend

It can propagate the error from the backend, but we should make the UI more user friendly, before submitting request to backend, the front-end should do the validation first.