Skip to content

fix(settings): reject a whitespace-only new password - #21058

Open
vbudhram wants to merge 1 commit into
mainfrom
fxa-9473
Open

fix(settings): reject a whitespace-only new password#21058
vbudhram wants to merge 1 commit into
mainfrom
fxa-9473

Conversation

@vbudhram

Copy link
Copy Markdown
Contributor

Because

  • The change-password form checked the length of the new password only, so eight spaces passed.
  • A user who saved a space-only password could not sign in again. The sign-in form rejects it.

This pull request

  • Adds a trim check to the length validator in FormPassword. It is the predicate FormPasswordWithInlineCriteria already uses.
  • Adds two tests: a space-only password is rejected, and a space-padded password with real content still works.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-9473

Checklist

Put an x in the boxes that apply

  • My commit is GPG signed.
  • If applicable, I have modified or added tests which pass locally.
  • I have added necessary documentation (if appropriate).
  • I have verified that my changes render correctly in RTL (if appropriate).
  • I have manually reviewed all AI generated code.

How to review (Optional)

  • Key files/areas to focus on: the length validator in FormPassword/index.tsx.
  • Suggested review order: the component, then the two tests.
  • Risky or complex parts: keep the predicate as value.length > 7 && value.trim() !== ''. The shorter value.trim().length > 7 also rejects a valid padded password such as " abc123 ", which locks out users whose password has padding.

Screenshots (Optional)

None. The failure shows on the existing "At least 8 characters" row, so there is no new copy and no layout change.

Other information (Optional)

  • PageCreatePassword had the same bug. It and PageChangePassword both render FormPassword, so this one change fixes both pages.
  • The auth server still accepts a whitespace-only password. That is a server-side decision and is out of scope here.
  • Ran locally: the FormPassword, PageChangePassword, and PageCreatePassword specs, 40 tests pass. Lint passes for fxa-settings.

## Because

- The change-password form checked the length of the new password only, so eight spaces passed.
- A user who saved a space-only password could not sign in again. The sign-in form rejects it.

## This pull request

- Adds a trim check to the `length` validator in `FormPassword`. It is the predicate `FormPasswordWithInlineCriteria` already uses.
- Adds two tests: a space-only password is rejected, and a space-padded password with real content still works.

## Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-9473
@vbudhram
vbudhram requested a review from a team as a code owner August 18, 2026 22:35
@vbudhram vbudhram added the auto label Aug 18, 2026
Copilot AI balanced review requested due to automatic review settings August 18, 2026 22:35
@vbudhram vbudhram added the auto label Aug 18, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Rejects whitespace-only passwords while preserving valid space-padded passwords.

Changes:

  • Adds non-whitespace validation to FormPassword.
  • Tests rejection and valid padding behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
FormPassword/index.tsx Rejects whitespace-only new passwords.
FormPassword/index.test.tsx Covers whitespace-only and padded passwords.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants