fix: reject Cyrillic characters in signup passwords - #2346
Open
mvanhorn wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a Cyrillic exclusion directly to
schemas.signUp.passwordinapps/codebattle/assets/js/widgets/formik/index.ts, using a Unicode-aware Cyrillic script match (for example a Yup test with/\p{Script=Cyrillic}/u) and the clear messagePassword must not contain Cyrillic characters. Preserve the existing required, length, Latin-letter, digit, and confirmation checks, and preserve the existing missing-letter error for the original example by placing the new validation after the existing composition checks. This implements the thread's requested Cyrillic restriction without silently converting password text or replacing the current allowed characters with an ASCII-only whitelist. Issue #2341 requests an inline validation error and blocked registration when the password contains Cyrillic characters. The original example,12345678ы, already fails the current signup schema's Latin-letter requirement, but the September 7 confirmation suppliesas1234567ыы, which satisfies the existing letter and digit checks and passes validation. The current code locates signup at/users/new, rather than the report's/signup, and submits valid form values to/api/v1/users. The concrete defect is the missing Cyrillic check in the signup form; the thread's alternative assertion of an unhandled server error supplies no response or stack trace establishing a separate server failure.Testing: Original report: submit otherwise valid values with
12345678ыin both password fields; showShould contain at least one letterand make no request; Confirmed failing case: submitas1234567ыыand matching confirmation; show the new Cyrillic-specific message and make no request. This case must fail against the existing code before the schema change.Fixes #2341