42.4. Assignments Security Theory 3

Submission
You must submit assignments using git
Create Repo
  • Create an empty repo on bitbucket.org, gitlab.com, or github.com,
  • git push your local repo to the above remote repo.
  • For node assignments the line node_modules/must be in your .gitignore file.
Submit
By email to with:
  • The word 'submission <subjectname>' in the subject line
  • The url(s) of your repo(s) in the body

42.4.1. Assignment Security H.0

In this assignment you must improve one of your earlier node projects. You must change the user registration so that it does not allow registration with a password contained in the rockyou.txt file of 14.3 million passwords.

In order to get the file clone this repo https://gitlab.com/arosano/rockyou.git and then unzip the file rockyou.zip til will give you the file.

A hint for handling the file: Use the Singleton pattern. This pattern consists of creating a class whose constructor is not available to the program. This means that the program can not do a let foo = new Rockyou();. Instead create a method in the class that can be called from the program, and this method creates the object and returns it to the program. If the object already exists the existing object is returned to the program. This way the big file only uses memory space once, and not per call.

Example 42.5. Pseudo Code for a Radical Rockyou Singleton, Rockyou.js
'use strict';
const fs = require('fs');

/*
 * Rockyou as Singleton, lean and mean
 */
class Rockyou {
    static rockyou = '';                // 14.3 million bad passwords
    static #filename = './rockyou.txt';

    static getRockyou() {
        if (Rockyou.rockyou === '')
            Rockyou.rockyou = fs.readFileSync(Rockyou.#filename, 'utf8');
    }
}

module.exports = Rockyou;

Calling it from some application:

Example 42.6. Driving Code, ./driver.js
'use strict';
const readlineSync = require('readline-sync');
const Rock = require('./Rockyou.js');   // require Rockyou Singleton
Rock.getRockyou();                      // populate rockyou

let arg = readlineSync.question('Enter password to check: ', {
  hideEchoBack: true
});

//: let arg = process.argv[2];              // get password from CLI
let regex = new RegExp(arg);            // create regex
if (regex.test(Rock.rockyou))           // test
    console.log('Keep trying, you can do it.');
else
    console.log('You chose wisely');