Check password length (#35062)

Automatic Merge

server/channels/app/users/password.go

@@ -25,6 +25,10 @@ func ComparePassword(hash string, password string) error {
 		return errors.New("empty password or hash")
 	}
 
+	if len(password) > model.PasswordMaximumLength {
+		return NewErrInvalidPassword("model.user.is_valid.pwd_max_length.app_error")
+	}
+
 	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
 }
 

server/channels/app/users/password_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/bcrypt"
 
 	"github.com/mattermost/mattermost/server/public/model"
 )
@@ -131,3 +132,23 @@ func TestIsPasswordValidWithSettings(t *testing.T) {
 		})
 	}
 }
+
+func TestComparePassword(t *testing.T) {
+	password := "a password"
+	hashBytes, err := bcrypt.GenerateFromPassword([]byte(password), 10)
+	require.NoError(t, err)
+	hash := string(hashBytes)
+
+	t.Run("password length ok", func(t *testing.T) {
+		err := ComparePassword(hash, password)
+		assert.NoError(t, err)
+	})
+
+	t.Run("password too long", func(t *testing.T) {
+		err := ComparePassword(hash, strings.Repeat("a", model.PasswordMaximumLength+1))
+		assert.Error(t, err)
+		errInvalid, ok := err.(*ErrInvalidPassword)
+		assert.True(t, ok)
+		assert.Equal(t, "model.user.is_valid.pwd_max_length.app_error", errInvalid.Id())
+	})
+}