writing regular expression for password validation

Question

I am working on input sanitation and want to write the regular expression for password validation. I was using OWASP ESAPI for the validation of the input parameters but I cant do that since regex provided for password validation by ESAPI is not satisfying all the conditions.

such as

• 8-20 characters using letters and numbers

• Cannot have 3 or more consecutive identical letters, numbers, or special characters

• Cannot contain a space

Optional:

• One or more special characters, except for “ & ' ⁄ < > [ \\ ] { | } ~ ^ !

• Case sensitive

PWASP ESAPI regex - ![CDATA[^(?:(?=.*\\d)(?=.*[AZ])(?=.*[az])|(?=.*\\d)(?=.*[^A-Za-z0-9])(?=.*[az])|(?=.*[^A-Za-z0-9])(?=.*[AZ])(?=.*[az])|(?=.*\\d)(?=.*[AZ])(?=.*[^A-Za-z0-9]))(?!.*(.)\\1{2,})[A-Za-z0-9!~<>,;:_=?*+#."&§%°()\\|\\[\\]\\-\\$\\^\\@\\/]{8,32}$]]

I tried to modify it but i was not getting expected results as well as i am not super confidant with regex as i never used them before. How can i create a regex that can incorporate all the conditions?

Thank you

Answer 1

I would suggest that you do not use RegEx for this, as it gets tedious to write, and even more tedious to maintain.

Preferably you'd look for a library that allows you to pass a configuration (something like passay ).

If you don't want that you should use common string functions to check for length ( str.length() , and existence of numbers and special characters (like str.matches() ).

Not only will it be easier to maintain - it will also be faster since very complicated RegEx queries can quickly get quite slow.

Answer 2

So i come up with solution but its in parts

so here are the regex for each condition

^((.)\\1{3}) - Cannot have 3 or more consecutive identical letters, numbers, or special characters

[a-zA-Z0-9\\S] - case sensitive cannot contain spaces and letters and numbers

[^ \\“ & '< > [ /]{|}~^!] - One or more special characters, except for “ & ' ⁄ < > [ \\ ] { | } ~ ^ !

{7,20}$ - range

but if combine them all together they wont work as expected...

any suggestion?