search

GoSimpleLLC / nbvcxz

Password strength estimator
MIT License
293 stars 56 forks source link

Is this library thread-safe? #47

Closed coreagile closed 5 years ago

coreagile commented 5 years ago

I've built a little command-line passphrase generator, and added your library in to calculate entropy for the generated passwords. I've noticed when I try to run multiple estimations in parallel with the same object, I get one of many kinds of errors:

  1. ConcurrentModificationException
  2. java.lang.IllegalStateException: There was an unexpected error and all of the matches put together do not equal the original password.
  3. Entropy of 0.0

Can you chime in on whether this object is thread-safe?

Thanks!

robin-maxxton commented 5 years ago

I tested the library with Apache Benchmark and came to same conclusion. The generateMatches method is not thread safe due to the presence of class variables. I've created a pull request to fix this (see #49)

Tostino commented 5 years ago

I just merged the PR, and am working on adding some concurrency tests to fix this going forward. Thanks raising the issue @coreagile, and thank you @robin-maxxton for the work on this!