Language: Python
Label: vulnerable
CWE: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Code:
    def assert_user_registration(self, username, follow=False):
        with patch("tcms.kiwi_auth.models.secrets") as _secrets:
            _secrets.token_hex.return_value = self.fake_activate_key

            try:
                # https://github.com/mbi/django-simple-captcha/issues/84
                # pylint: disable=import-outside-toplevel
                from captcha.conf import settings as captcha_settings

                captcha_settings.CAPTCHA_TEST_MODE = True

                response = self.client.post(
                    self.register_url,
                    {
                        "username": username,
                        "password1": "password",
                        "password2": "password",
                        "email": "new-tester@example.com",
                        "captcha_0": "PASSED",
                        "captcha_1": "PASSED",
                    },
                    follow=follow,
                )
            finally:
                captcha_settings.CAPTCHA_TEST_MODE = False

        user = User.objects.get(username=username)
        self.assertEqual("new-tester@example.com", user.email)
        if User.objects.filter(is_superuser=True).count() == 1 and user.is_superuser:
            self.assertTrue(user.is_active)
        else:
            self.assertFalse(user.is_active)

        key = UserActivationKey.objects.get(user=user)
        self.assertEqual(self.fake_activate_key, key.activation_key)

        return response, user