Question

I use java and a regexp.

I’ve made a regexp for password validation :

String PASSWORD_PATTERN_ADVANCED = "^(?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\\\\@#$¤£µ§%&<>,.!:?;~{-|`'_^¨éèçàù)=}()°\"\\]\\[²³*/+]).{8,20}$";

or without the extra slash :

^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\\@#$¤£µ§%&<>,.!:?;~{-|`'_^¨éèçàù)=}()°"\]\[²³*/+]).{8,20}$

whuch means (i may be wrong): at least one digit / at least one lowercase / at least one uppercase / at least one of the special chars listed / with a minimum total length of 8 and a max of 20…

made a test case generating password for success and failure…

success -> OK, all passed
failure -> Almost OK …

The only password that fails to fail 😀 are the ones with space in it like :

 iF\ !h6 2A3|Gm 
¨I O7 gZ2%L£k vd~39 
2< A Uw a7kEw6,6S^ 
cC2c5N#  
6L kIw~ Béj7]5 
ynRZ #44ç 
9A `sè53Laj A 
s²R[µ3  9UrR q8n 

I am puzzled.

Any thoughts to make it works ?

Thanks

Answer 1

A regex may not be the right tool for the job here.

Regexes are best suited for matching patterns; what you’re describing isn’t really a pattern, per se; it’s more of a rule set. Sure, you may be able to create some regex that helps, but it’s a really complex and opaque piece of code which make maintenance a challenge.

A method like this might be a better fit:

public boolean isValidPassword(String password) {
    boolean containsLowerCase;
    boolean containsUpperCase;
    boolean containsInvalid;
    boolean containsSpecialChar;
    boolean containsDigit;

    for(char c: password.toCharArray()) {
        containsLowerCase   ||= Character.isLowerCase(c);
        containsUpperCase   ||= Character.isUpperCase(c);
        containsDigit       ||= Character.isDigit(c); 
        containsSpecialChar ||= someMethodForDetectingIfItIsSpecial(c);

    }

    return  containsLowerCase &&
            containsUpperCase &&
            containsSpecialChar &&
            containsDigit &&
            !containsInvalid &&
            password.length >=8 && password.length <=20;

}

You’d need to decide the best way to detect a special character (specialCharArray.contains(c), regular expression, etc).

However, this approach would make adding new rules a lot simpler.