[FormAnalyzer] scoring password hints #720
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dbajpeyi
force-pushed
the
dbajpeyi/feature/password-hints
branch
from
201c856 to
0640b6f
Compare
dbajpeyi
changed the title
| }); | ||
| } | ||
|
|
||
| evaluatePasswordHints() { |
There was a problem hiding this comment.
Looping through divs and spans is complex and potentially expensive. What if instead we looked at the whole form textContent and run the regex once per form? We'd need to increase the TEXT_LENGTH_CUTOFF, or have a carveout for this situation, like making safeRegexTest accept a parameter and then have another higher cutoff constant we can use here.
dbajpeyi
changed the title
dbajpeyi
force-pushed
the
dbajpeyi/feature/password-hints
branch
from
5efa4cd to
71d51da
Compare
dbajpeyi
commented
Dec 20, 2024
| if (this.form.textContent) { | ||
| const hasPasswordHints = safeRegexTest(this.matching.getDDGMatcherRegex('passwordHintsRegex'), this.form.textContent, 200); | ||
| if (hasPasswordHints) { | ||
| this.increaseSignalBy(5, 'Password hints'); |
There was a problem hiding this comment.
I have given a much stronger score to hints, as they seem to be a very clear indicator.
dbajpeyi
commented
Dec 20, 2024
| @@ -331,11 +345,16 @@ class FormAnalyzer { | |||
| } | |||
|
|
|||
| // A form with many fields is unlikely to be a login form | |||
| const relevantFields = this.form.querySelectorAll(this.matching.cssSelector('genericTextField')); | |||
| const relevantFields = this.form.querySelectorAll(this.matching.cssSelector('genericTextInputField')); | |||
dbajpeyi
force-pushed
the
dbajpeyi/feature/password-hints
branch
from
71d51da to
a110052
Compare
dbajpeyi
commented
Dec 20, 2024
| if (relevantFields.length >= 4) { | ||
| this.increaseSignalBy(relevantFields.length * 1.5, 'many fields: it is probably not a login'); | ||
| } | ||
|
|
||
| // If we can't decide at this point, try reading password hints | ||
| if (this.areLoginOrSignupSignalsWeak()) { |
There was a problem hiding this comment.
If we see more examples in triages, I might just remove this check. But for now feels safer.
dbajpeyi
commented
Dec 20, 2024
| @@ -442,6 +442,9 @@ const matchingConfiguration = { | |||
| // French | |||
| '| avec ', | |||
| }, | |||
| passwordHintsRegex: { | |||
| match: '\\b(?:password.*?(?:must|should|has to|needs to|can))?\\b.*?(?:(at least|minimum|no fewer than)\\s+\\d+\\s+(characters?|letters?|numbers?|special characters?)|(uppercase|lowercase|capital|digit|number|symbol|special character)|\b(no spaces|cannot contain your email|cannot repeat characters|must be unique|case sensitive)\\b)', | |||
There was a problem hiding this comment.
The regex is based on sleeper.com's text.
dbajpeyi
force-pushed
the
dbajpeyi/feature/password-hints
branch
from
a110052 to
7402c0d
Compare
dbajpeyi
changed the title
dbajpeyi
force-pushed
the
dbajpeyi/feature/password-hints
branch
from
83b7d1c to
d494250
Compare
dbajpeyi
force-pushed
the
dbajpeyi/feature/password-hints
branch
from
d494250 to
cb29187
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Reviewer: @GioSensation
Asana: https://app.asana.com/0/1203822806345703/1208965540697669/f
Description
evaluateForminstead of in the constructor. This way all inputs get evaluated for. Hindustan times got regressed because of this, but that form seems a bit out of date. I think their new login form is different.Steps to test
https://sleeper.com/create?type=league is the site that was originally broken.
Score before:
Score after:
