careapp-group / zxcvbn-dart

Dart port of DropBox's Zxcvbn for use in Flutter and other Dart apps
https://pub.dev/packages/zxcvbn
MIT License
11 stars 6 forks source link

Some passwords trigger an infinite loop that runs the browser tab OOM #14

Open garrickpeterson-wf opened 1 year ago

garrickpeterson-wf commented 1 year ago

Passwords with two years that match "recent dates" criteria cause an infinite loop of matching that runs the browser tab OOM. I've reproduced this on current versions of Chrome, Firefox, and Safari.

To reproduce, evaluate the password 19922009.

My investigations lead me to regex_match in matching.dart. It appears that the index advancement does not work as intended, causing a loop that checks the two values "22009" and "2009" repeatedly.

patkujawa-wf commented 1 year ago

Sounds like https://github.com/careapp-inc/zxcvbn-dart/pull/11