Password validtion added to prevent security issue with bcrypt hashing

apps/api/src/app/auth/dtos/register-user.dto.ts

@@ -1,5 +1,5 @@
 import { ApiProperty } from '@nestjs/swagger';
-import { IsDefined, IsString, IsEmail, IsOptional } from 'class-validator';
+import { IsDefined, IsString, IsEmail, IsOptional, MaxLength } from 'class-validator';
 
 export class RegisterUserDto {
   @ApiProperty({
@@ -28,6 +28,7 @@ export class RegisterUserDto {
   })
   @IsString()
   @IsDefined()
+  @MaxLength(24)
   password: string;
 
   @ApiProperty({

apps/api/src/app/auth/dtos/reset-password.dto.ts

@@ -1,9 +1,10 @@
 import { ApiProperty } from '@nestjs/swagger';
-import { IsDefined, IsString, IsUUID } from 'class-validator';
+import { IsDefined, IsString, IsUUID, MaxLength } from 'class-validator';
 
 export class ResetPasswordDto {
   @IsString()
   @IsDefined()
+  @MaxLength(24)
   @ApiProperty({
     description: 'New password of the user',
   })

apps/web/config/constants.config.ts

@@ -24,6 +24,7 @@ export const CONSTANTS = {
     'An error occurred with the payment. No amount has been deducted. Please try again later or contact the support team.',
   SUBSCRIPTION_ACTIVATED_TITLE: 'Subscription activated',
   SUBSCRIPTION_FAILED_TITLE: 'Payment failed',
+  MAX_PASSWORD_LENGTH: 24,
   SAMPLE_IMPORT_NAME: 'Product Data Import',
 };
 
@@ -468,7 +469,7 @@ export enum PLANCODEENUM {
   GROWTH_YEARLY = 'GROWTH-YEARLY',
   STARTER = 'STARTER',
 }
-export const plans: { monthly: Plan[]; yearly: Plan[] } = {
+export const plans: { monthly: Plan[]; yearly: Plan[]; } = {
   monthly: [
     {
       name: 'Starter (Default)',

apps/web/hooks/auth/useResetPassword.tsx

@@ -3,7 +3,7 @@ import { useRouter } from 'next/router';
 import { useForm } from 'react-hook-form';
 import { useMutation } from '@tanstack/react-query';
 
-import { API_KEYS, ROUTES } from '@config';
+import { API_KEYS, CONSTANTS, ROUTES } from '@config';
 import { commonApi } from '@libs/api';
 import { IErrorObject, ILoginResponse, SCREENS } from '@impler/shared';
 import { track } from '@libs/amplitude';
@@ -19,7 +19,11 @@ interface IResetPasswordData extends IResetPasswordFormData {
 
 export function useResetPassword() {
   const { push, query } = useRouter();
-  const { register, handleSubmit } = useForm<IResetPasswordFormData>();
+  const {
+    register,
+    handleSubmit,
+    setError,
+    formState: { errors }, } = useForm<IResetPasswordFormData>();
   const {
     mutate: resetPassword,
     isLoading: isResetPasswordLoading,
@@ -49,6 +53,12 @@ export function useResetPassword() {
   };
 
   const onResetPassword = (data: IResetPasswordFormData) => {
+    if (data.password && data.password.length > CONSTANTS.MAX_PASSWORD_LENGTH) {
+      setError("password", {
+        type: "manual",
+        message: `Password length must be less than ${CONSTANTS.MAX_PASSWORD_LENGTH}!`
+      });
+    }
     resetPassword({
       ...data,
       token: query.token as string,
@@ -57,6 +67,7 @@ export function useResetPassword() {
 
   return {
     error,
+    errors,
     isError,
     register,
     goToLogin,

apps/web/hooks/auth/useSignup.tsx

@@ -5,7 +5,7 @@ import { useForm } from 'react-hook-form';
 import { useMutation, useQuery } from '@tanstack/react-query';
 
 import { notify } from '@libs/notify';
-import { API_KEYS, NOTIFICATION_KEYS, ROUTES } from '@config';
+import { API_KEYS, CONSTANTS, NOTIFICATION_KEYS, ROUTES } from '@config';
 import { commonApi } from '@libs/api';
 import { track } from '@libs/amplitude';
 import { useAppState } from 'store/app.context';
@@ -40,7 +40,7 @@ export function useSignup() {
   const [isInvitationLink, setIsInvitationLink] = useState<boolean | undefined>();
   const invitationId = query.invitationId as string | undefined;
 
-  const { isLoading: isAcceptingInvitation, isError } = useQuery<any, IErrorObject, { email: string }>(
+  const { isLoading: isAcceptingInvitation, isError } = useQuery<any, IErrorObject, { email: string; }>(
     [API_KEYS.GET_TEAM_INVITATIONS, invitationId],
     () =>
       commonApi(API_KEYS.GET_TEAM_INVITATIONS as any, {
@@ -99,6 +99,13 @@ export function useSignup() {
   });
 
   const onSignup = (data: ISignupFormData) => {
+    if (data.password && data.password.length > CONSTANTS.MAX_PASSWORD_LENGTH) {
+      setError("password", {
+        type: "manual",
+        message: `Password length must be less than ${CONSTANTS.MAX_PASSWORD_LENGTH}!`
+      });
+      return;
+    }
     const signupData: ISignupData = {
       firstName: data.fullName.split(' ')[0],
       lastName: data.fullName.split(' ')[1],

apps/web/pages/auth/reset/[token].tsx

@@ -9,8 +9,8 @@ import { OnboardLayout } from '@layouts/OnboardLayout';
 import { useResetPassword } from '@hooks/auth/useResetPassword';
 import { PLACEHOLDERS, ROUTES, colors } from '@config';
 
-export default function ResetPasswordPage({}) {
-  const { register, resetPassword, error, isError } = useResetPassword();
+export default function ResetPasswordPage({ }) {
+  const { register, resetPassword, error, isError, errors } = useResetPassword();
 
   return (
     <>
@@ -44,9 +44,9 @@ export default function ResetPasswordPage({}) {
             Back to <Link href={ROUTES.SIGNIN}>Signin</Link>
           </Text>
         </Stack>
-        {isError && (
+        {isError || errors.password.message && (
           <Text mt={20} size="md" align="center" color={colors.danger}>
-            {error?.message}
+            {error?.message || errors.password.message}
           </Text>
         )}
       </form>