Summary
In @rocket.chat/password-policies, forbidRepeatingCharactersCount is directly interpolated into a RegExp string constructor without input validation or type sanitization.
Location
packages/password-policies/src/PasswordPolicy.ts (lines 80-95)
Problem Description
If forbidRepeatingCharactersCount receives an invalid option (e.g., negative values like -1, NaN, or non-integer inputs passed via settings/configuration), new RegExp('(.)\\1{-1,}') throws an uncaught SyntaxError: Invalid regular expression.
// Current Implementation:
this.regex = {
forbiddingRepeatingCharacters: new RegExp(`(.)\\1{${forbidRepeatingCharactersCount},}`),
};Proposed Fix
Sanitize forbidRepeatingCharactersCount before constructing the regex to ensure it is a valid integer >= 1, falling back gracefully to the default count (3) if invalid:
const safeForbidRepeatingCharactersCount =
typeof forbidRepeatingCharactersCount === 'number' && Number.isInteger(forbidRepeatingCharactersCount) && forbidRepeatingCharactersCount >= 1
? forbidRepeatingCharactersCount
: 3;
this.regex = {
forbiddingRepeatingCharacters: new RegExp(`(.)\\1{${safeForbidRepeatingCharactersCount},}`),
// ...
};Pull Request
A fix has been created locally on branch fix/password-policy-regex-validation with full unit test coverage.
Summary
In
@rocket.chat/password-policies,forbidRepeatingCharactersCountis directly interpolated into aRegExpstring constructor without input validation or type sanitization.Location
packages/password-policies/src/PasswordPolicy.ts(lines 80-95)Problem Description
If
forbidRepeatingCharactersCountreceives an invalid option (e.g., negative values like-1,NaN, or non-integer inputs passed via settings/configuration),new RegExp('(.)\\1{-1,}')throws an uncaughtSyntaxError: Invalid regular expression.Proposed Fix
Sanitize
forbidRepeatingCharactersCountbefore constructing the regex to ensure it is a valid integer >= 1, falling back gracefully to the default count (3) if invalid:Pull Request
A fix has been created locally on branch
fix/password-policy-regex-validationwith full unit test coverage.