search

dhui / passhash

Go library providing simple and secure password management
Apache License 2.0
8 stars 4 forks source link

Limit the max number of `PasswordPolicyError`s that are appended to PasswordPoliciesNotMet #16

Open dhui opened 3 months ago

dhui commented 3 months ago

Not having a limit opens the door for a DoS attack if an organization has many password policies and an attacker crafts a password that fails them all. e.g. potentially unbounded memory allocated

Reported in https://hackerone.com/reports/2441029