I tried to do an assignment of making a strong password validator using regex. But I feel like I'm not doing it right. Could anyone just have a look at it and give me pointers?
#🔒 Is there a more elegant way to do this?
tropic badger
muted salmonBOT
I tried to do an assignment of making a strong password validator using regex. B...
@tropic badger
Python help channel opened
tropic badger
I was suggested to use dictionaries but I don't understand how to use them here even though I learned about it.
latent carbon
I tried to do an assignment of making a strong password validator using regex. B...
Im not sure what you're trying to do here:
#for loop to create a dictionary of matches
for i in range(0,3):
matchlst[i] = 'mat' + {i}
but it throws an error as you cannot join string and sets
Your current implementation is fine, idk how you would use dictionary in this, but maybe a list or tuple would work (or even a set)? For storing a sequence of regex patterns and looping over them while applying, instead of creating a new variable for every pattern
And your this chain of conditional statements-
if mat0 != None:
if mat1 != None:
if mat2 != None:
if mat3 != None:
print(f'{passwd} is a valid password')
else:
print("invalid Password")
else:
print("invalid Password")
else:
print("invalid Password")
else:
print("invalid password")
Can be written as-
if mat0 is None or mat1 is None or mat2 is None or mat3 is None:
print("Invalid password")
else:
print(f'{passwd} is a valid password')
I was trying to automate the matches instead of manually typing each line(it felt like I was not programming the right way)
tropic badger
And your this chain of conditional statements-
```py
if mat0 != None:
if mat...
I think this will give some error saying the object can't be None?
Wait let me check
latent carbon
I think this will give some error saying the object can't be None?
No, I just made your chain of if statements easier to read in a single line
tropic badger
Oh my bad.. thanks!
Should I have made some kind of exception handling or... packaged it into a function?
Or is this fine for an assignment?
latent carbon
Should I have made some kind of exception handling or... packaged it into a func...
Where will you add error handling though?
tropic badger
uhh.. I don't know.. I am back trying to learn programming after like 2 months and I'm just nervous about if I'm doing it right 😅
tropic badger
Ok ok. Thanks!
latent carbon
Ok ok. Thanks!
If you want to make it slightly better, you can use the all function to do so-
if all((mat0, mat1, mat2, mat3)):
print(f'{passwd} is a valid password')
else:
print("Invalid password")
The function takes in an iterable and checks if every element is truthy, if it is then it returns true
truthy elements are those which are non-zero, non-empty data, not False nor None
nova oak
i generaly use try/catch for stuff that is "secure"
vast plover
hmm perhaps "better" would be expandable, or even submitting the match types.
def validate_password(passwd, matches):
psw_valid = [k for k, v in matches.items() if v is None]
if psw_valid:
print(f"Invalid password {missing=}")
else:
print(f"{passwd} is a valid password")
def validate_password(password: str):
# NEGATIVE / INVERSE CHECKING
if len(password) < 12:
raise ValueError("Password too short (must be ≥ 12 characters)")
if password.islower() or password.isupper():
raise ValueError("Password must contain both upper and lower case characters")
if password.isalnum():
raise ValueError("Password must include at least one symbol")
if " " in password:
raise ValueError("Password must not contain spaces")```
using negative/inverse pattern matchingwhen checking for passwords/security events you should check for what the condition isnot, not for what it is (generaly)
then you use a block like this for the actual input ```python
def hash_password(password: str) -> str:
return hashlib.sha256(password.encode()).hexdigest()
password = input("Enter password: ")
try:
validate_password(password)
except Exception as e:
print(f"Password rejected: {e}")
else:
hashed = hash_password(password)
print(f"Password accepted. Hash: {hashed}")```
so you run the password input against the validation funtion that does negative matching
latent carbon
I usually try to follow the principle of "Ask for permission instead of forgiveness", meaning trying to ask for permission via if statements and giving them priority whenever, over asking for forgiveness via exception handling
nova oak
yeah never do that with passwords
explict deny/negative pattern matching is the accepted standard for secure software engineering
postive matching allows for unintended matching and bypass of security
latent carbon
you can still get explicit positive/negative pattern matching with if statements too
its just a design choice
but whatever suits you
nova oak
not really, CIS, MS SDL, NIST all enforce negative matching with defult deny
its not so much a "whatever suits you" case, its a case where there are accepted design preincpiles from the security side of our profession
if you want the bible https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
latent carbon
I see
potent trench
I tried to do an assignment of making a strong password validator using regex. B...
You might like to try zxcvbn
muted salmonBOT
Python help channel closed for inactivity