Users: passwords containing a colon are rejected with a generic failure message #65

New issue

Closed

opened 2026-10-13 19:14:18 +08:00 by Breadway · 2 comments

Breadway commented

2026-10-13 19:14:18 +08:00

Owner

How it was found

Code reading of src/src/commands/users.rs and frontend/src/lib/views/Users.svelte while working on BSET-46. Not reproduced against a real system (no pkexec calls were made, by rule).

Confidence

High for the code path, not run live.

Explanation

valid_chpasswd_password rejects any password containing ':' (and newlines, NUL, or longer than 512 bytes) because chpasswd reads user:password lines. add_user and change_password return "invalid password" in that case. In Users.svelte, the change-password sheet catches the error and shows only "The password wasn't changed", and the Add sheet just prints the raw error. A user who picks a password with a colon gets no hint why. The sheets should say "Passwords can't contain a colon" up front, or the backend could avoid the restriction by setting the password another way (for example passwd --stdin style or a chpasswd -e hashed input).

Smaller related nit: the Add sheet hint says "Lowercase letters and numbers" but valid_username also allows _ and -.

## How it was found Code reading of src/src/commands/users.rs and frontend/src/lib/views/Users.svelte while working on BSET-46. Not reproduced against a real system (no pkexec calls were made, by rule). ## Confidence High for the code path, not run live. ## Explanation valid_chpasswd_password rejects any password containing ':' (and newlines, NUL, or longer than 512 bytes) because chpasswd reads user:password lines. add_user and change_password return "invalid password" in that case. In Users.svelte, the change-password sheet catches the error and shows only "The password wasn't changed", and the Add sheet just prints the raw error. A user who picks a password with a colon gets no hint why. The sheets should say "Passwords can't contain a colon" up front, or the backend could avoid the restriction by setting the password another way (for example passwd --stdin style or a chpasswd -e hashed input). Smaller related nit: the Add sheet hint says "Lowercase letters and numbers" but valid_username also allows _ and -.

Breadway self-assigned this

2026-10-14 09:24:20 +08:00

Breadway commented

2026-10-14 12:42:19 +08:00

Author

Owner

PR: #82

PR: https://git.breadway.dev/Breadway/bos-settings/pulls/82

Breadway closed this issue

2026-10-14 13:56:09 +08:00

Breadway commented

2026-10-14 18:12:25 +08:00

Author

Owner

Verified on merge 9b07bcf (PR #82): svelte-check 0/0, npm test, build, fmt, clippy -D warnings, cargo test 180 passed incl. colon_in_password_is_one_entry and the injection tests. Reviewer checked shadow-utils chpasswd.c (split at first ':' only; PAM path receives the split strings). Live VM on the PR head: change to a:b-pass-99 showed Password changed, and su to that user with a:b-pass-99 succeeded.

Verified on merge 9b07bcf (PR #82): svelte-check 0/0, npm test, build, fmt, clippy -D warnings, cargo test 180 passed incl. colon_in_password_is_one_entry and the injection tests. Reviewer checked shadow-utils chpasswd.c (split at first ':' only; PAM path receives the split strings). Live VM on the PR head: change to a:b-pass-99 showed Password changed, and su to that user with a:b-pass-99 succeeded.