test_password_policy.py 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182
  1. # Copyright 2019 The Matrix.org Foundation C.I.C.
  2. #
  3. # Licensed under the Apache License, Version 2.0 (the "License");
  4. # you may not use this file except in compliance with the License.
  5. # You may obtain a copy of the License at
  6. #
  7. # http://www.apache.org/licenses/LICENSE-2.0
  8. #
  9. # Unless required by applicable law or agreed to in writing, software
  10. # distributed under the License is distributed on an "AS IS" BASIS,
  11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. # See the License for the specific language governing permissions and
  13. # limitations under the License.
  14. import json
  15. from http import HTTPStatus
  16. from twisted.test.proto_helpers import MemoryReactor
  17. from synapse.api.constants import LoginType
  18. from synapse.api.errors import Codes
  19. from synapse.rest import admin
  20. from synapse.rest.client import account, login, password_policy, register
  21. from synapse.server import HomeServer
  22. from synapse.util import Clock
  23. from tests import unittest
  24. class PasswordPolicyTestCase(unittest.HomeserverTestCase):
  25. """Tests the password policy feature and its compliance with MSC2000.
  26. When validating a password, Synapse does the necessary checks in this order:
  27. 1. Password is long enough
  28. 2. Password contains digit(s)
  29. 3. Password contains symbol(s)
  30. 4. Password contains uppercase letter(s)
  31. 5. Password contains lowercase letter(s)
  32. For each test below that checks whether a password triggers the right error code,
  33. that test provides a password good enough to pass the previous tests, but not the
  34. one it is currently testing (nor any test that comes afterward).
  35. """
  36. servlets = [
  37. admin.register_servlets_for_client_rest_resource,
  38. login.register_servlets,
  39. register.register_servlets,
  40. password_policy.register_servlets,
  41. account.register_servlets,
  42. ]
  43. def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
  44. self.register_url = "/_matrix/client/r0/register"
  45. self.policy = {
  46. "enabled": True,
  47. "minimum_length": 10,
  48. "require_digit": True,
  49. "require_symbol": True,
  50. "require_lowercase": True,
  51. "require_uppercase": True,
  52. }
  53. config = self.default_config()
  54. config["password_config"] = {
  55. "policy": self.policy,
  56. }
  57. hs = self.setup_test_homeserver(config=config)
  58. return hs
  59. def test_get_policy(self) -> None:
  60. """Tests if the /password_policy endpoint returns the configured policy."""
  61. channel = self.make_request("GET", "/_matrix/client/r0/password_policy")
  62. self.assertEqual(channel.code, HTTPStatus.OK, channel.result)
  63. self.assertEqual(
  64. channel.json_body,
  65. {
  66. "m.minimum_length": 10,
  67. "m.require_digit": True,
  68. "m.require_symbol": True,
  69. "m.require_lowercase": True,
  70. "m.require_uppercase": True,
  71. },
  72. channel.result,
  73. )
  74. def test_password_too_short(self) -> None:
  75. request_data = json.dumps({"username": "kermit", "password": "shorty"})
  76. channel = self.make_request("POST", self.register_url, request_data)
  77. self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
  78. self.assertEqual(
  79. channel.json_body["errcode"],
  80. Codes.PASSWORD_TOO_SHORT,
  81. channel.result,
  82. )
  83. def test_password_no_digit(self) -> None:
  84. request_data = json.dumps({"username": "kermit", "password": "longerpassword"})
  85. channel = self.make_request("POST", self.register_url, request_data)
  86. self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
  87. self.assertEqual(
  88. channel.json_body["errcode"],
  89. Codes.PASSWORD_NO_DIGIT,
  90. channel.result,
  91. )
  92. def test_password_no_symbol(self) -> None:
  93. request_data = json.dumps({"username": "kermit", "password": "l0ngerpassword"})
  94. channel = self.make_request("POST", self.register_url, request_data)
  95. self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
  96. self.assertEqual(
  97. channel.json_body["errcode"],
  98. Codes.PASSWORD_NO_SYMBOL,
  99. channel.result,
  100. )
  101. def test_password_no_uppercase(self) -> None:
  102. request_data = json.dumps({"username": "kermit", "password": "l0ngerpassword!"})
  103. channel = self.make_request("POST", self.register_url, request_data)
  104. self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
  105. self.assertEqual(
  106. channel.json_body["errcode"],
  107. Codes.PASSWORD_NO_UPPERCASE,
  108. channel.result,
  109. )
  110. def test_password_no_lowercase(self) -> None:
  111. request_data = json.dumps({"username": "kermit", "password": "L0NGERPASSWORD!"})
  112. channel = self.make_request("POST", self.register_url, request_data)
  113. self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
  114. self.assertEqual(
  115. channel.json_body["errcode"],
  116. Codes.PASSWORD_NO_LOWERCASE,
  117. channel.result,
  118. )
  119. def test_password_compliant(self) -> None:
  120. request_data = json.dumps({"username": "kermit", "password": "L0ngerpassword!"})
  121. channel = self.make_request("POST", self.register_url, request_data)
  122. # Getting a 401 here means the password has passed validation and the server has
  123. # responded with a list of registration flows.
  124. self.assertEqual(channel.code, HTTPStatus.UNAUTHORIZED, channel.result)
  125. def test_password_change(self) -> None:
  126. """This doesn't test every possible use case, only that hitting /account/password
  127. triggers the password validation code.
  128. """
  129. compliant_password = "C0mpl!antpassword"
  130. not_compliant_password = "notcompliantpassword"
  131. user_id = self.register_user("kermit", compliant_password)
  132. tok = self.login("kermit", compliant_password)
  133. request_data = json.dumps(
  134. {
  135. "new_password": not_compliant_password,
  136. "auth": {
  137. "password": compliant_password,
  138. "type": LoginType.PASSWORD,
  139. "user": user_id,
  140. },
  141. }
  142. )
  143. channel = self.make_request(
  144. "POST",
  145. "/_matrix/client/r0/account/password",
  146. request_data,
  147. access_token=tok,
  148. )
  149. self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
  150. self.assertEqual(channel.json_body["errcode"], Codes.PASSWORD_NO_DIGIT)