1214492 - New PW containing the special character "§" is rejected

Status: RESOLVED WORKSFORME

(Bugzilla :: User Accounts, defect)

Description

[Jeff Fearn 🐞]

Attachment: switch from punct to Punct

For sites using letters_numbers_specialchars complexity for passwords, UTF8 punctuation is not matched. Switching to a UTF8 punctuation handles this and increases complexity.

Comment 1

[Gervase Markham [:gerv]]

Jeff: do we want to do the same for "alpha" and the digits check also, i.e. require use of Unicode letters and Unicode digits?

Gerv

Comment 2

[Jeff Fearn 🐞]

(In reply to Gervase Markham [:gerv] from comment #1)
> Jeff: do we want to do the same for "alpha" and the digits check also, i.e.
> require use of Unicode letters and Unicode digits?
> 
> Gerv

Yeah that makes sense.

Comment 3

[Jeff Fearn 🐞]

Attachment: Make complex password check UTF8 aware

Comment 4

[Frédéric Buclin]

Comment on attachment 8673999 [details] [diff] [review]
Make complex password check UTF8 aware

>-          if ($password !~ /[[:alpha:]]/ || $password !~ /\d/ || $password !~ /[[:punct:]]/);
>+          if ($password !~ /\p{XPosixAlpha}/ || $password !~ /\p{XPosixDigit}/ || $password !~ /\p{XPosixPunct}/);


In Unicode, [[:punct:]] and \p{XPosixPunct} are equivalent, see http://perldoc.perl.org/perlrecharclass.html#[5].
Also, \d understands Unicode digits correctly, so it doesn't need to be replaced by any \p{} construct, see http://perldoc.perl.org/perlrecharclass.html#Digits.

Comment 5

[Frédéric Buclin]

I typed "foobar7§" together with the letters_numbers_specialchars complexity and it has been correctly accepted. I wonder if that's a bug in Perl < 5.12 (assuming RH still runs 5.10.1).

Comment 6

[Jeff Fearn 🐞]

(In reply to Frédéric Buclin from comment #5)
> I typed "foobar7§" together with the letters_numbers_specialchars complexity
> and it has been correctly accepted. I wonder if that's a bug in Perl < 5.12
> (assuming RH still runs 5.10.1).

This could be it.

On perl 5.10.1:

$ perl -le 'use utf8; if(q{§} =~ /[[:punct:]]/){ print "match\n"; } else { print "no match\n"; }'
no match

On perl 5.20.3

$ perl -le 'use utf8; if(q{§} =~ /[[:punct:]]/){ print "match\n"; } else { print "no match\n"; }'
match

The 5.10 pod [1] makes no reference to this and I can't find any bugs mentioning it specifically, but there appears to have been some major reworking to unicode support in 5.12 so maybe it's a side affect of another change.

1: http://search.cpan.org/~dapm/perl-5.10.1/pod/perlrecharclass.pod

And it turns out that the patch doesn't fix it on 5.10.1 anyway :/

# perl -le 'use utf8; if(q{§} =~ /\p{PosixPunct}/){ print "match\n";}else{print "no match\n";}'
no match

$ perl -le 'use utf8; if(q{§} =~ /\p{XPosixPunct}/){ print "match\n";}else{print "no match\n";}'
Can't find Unicode property definition "XPosixPunct" at -e line 1.

Bump min perl to 5.12?

Comment 7

[Frédéric Buclin]

(In reply to Jeff Fearn from comment #6)
> Bump min perl to 5.12?

Yes, we plan to upgrade to 5.14 directly due to a much better Unicode support, see bug 1136137.