From 77114682ddbc637539e9cdcea497b6d20a462449 Mon Sep 17 00:00:00 2001 From: Brainslug Date: Wed, 10 Jun 2026 16:33:25 +0200 Subject: [PATCH 1/3] Add mention of password policy to best practices --- content/guides/13.security/1.best-practices.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/guides/13.security/1.best-practices.md b/content/guides/13.security/1.best-practices.md index 58e2be2ba..743107550 100644 --- a/content/guides/13.security/1.best-practices.md +++ b/content/guides/13.security/1.best-practices.md @@ -113,6 +113,13 @@ Administrator accounts can read and write any data in the project and change per Require [Two-Factor Authentication](/guides/auth/2fa) for every user with an administrator policy, and review the administrator user list on a regular cadence. +### Use Safe Password Policy Patterns + +The password policy (Settings → Auth → Password Policy) is a regular expression evaluated against every submitted password. The built-in **Weak** and **Strong** presets are safe, but a custom pattern with nested quantifiers (`(a+)+$`) can be vulnerable to catastrophic backtracking. Because the match runs on the main event loop and is evaluated wherever passwords are set, including public registration and password reset, a slow pattern can be triggered remotely to block the instance. + +- Prefer the built-in presets, which are safe by design. +- If you author a custom pattern, avoid nested quantifiers (`(x+)+`, `(x*)*`) and test it against long, non-matching inputs before deploying. + ## Files & Assets ### Restrict Public File Uploads From 4f577c074c109c84fecb33cc0e9c42af4a3f1aa8 Mon Sep 17 00:00:00 2001 From: Brainslug Date: Wed, 10 Jun 2026 17:16:49 +0200 Subject: [PATCH 2/3] Update content/guides/13.security/1.best-practices.md Co-authored-by: judda <44623501+ComfortablyCoding@users.noreply.github.com> --- content/guides/13.security/1.best-practices.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/guides/13.security/1.best-practices.md b/content/guides/13.security/1.best-practices.md index 743107550..0210d761e 100644 --- a/content/guides/13.security/1.best-practices.md +++ b/content/guides/13.security/1.best-practices.md @@ -115,7 +115,9 @@ Require [Two-Factor Authentication](/guides/auth/2fa) for every user with an adm ### Use Safe Password Policy Patterns -The password policy (Settings → Auth → Password Policy) is a regular expression evaluated against every submitted password. The built-in **Weak** and **Strong** presets are safe, but a custom pattern with nested quantifiers (`(a+)+$`) can be vulnerable to catastrophic backtracking. Because the match runs on the main event loop and is evaluated wherever passwords are set, including public registration and password reset, a slow pattern can be triggered remotely to block the instance. +The password policy (Settings → Auth → Password Policy) is a regular expression evaluated against every submitted password. The built-in **Weak** and **Strong** presets are designed to be safe. However, custom patterns have no such restriction, adding a custom rule with nested quantifiers (e.g. `(a+)+$`) can be vulnerable to catastrophic backtracking. + +Since password validation runs on the main event loop and is performed whenever a password is created or updated (including public registration and password resets) a poorly designed pattern could be exploited remotely to degrade performance or make the instance unresponsive. - Prefer the built-in presets, which are safe by design. - If you author a custom pattern, avoid nested quantifiers (`(x+)+`, `(x*)*`) and test it against long, non-matching inputs before deploying. From 9bd6e4e1677c635bbcc786e53f44d4dc924618d7 Mon Sep 17 00:00:00 2001 From: Brainslug Date: Wed, 10 Jun 2026 17:17:29 +0200 Subject: [PATCH 3/3] Update content/guides/13.security/1.best-practices.md Co-authored-by: judda <44623501+ComfortablyCoding@users.noreply.github.com> --- content/guides/13.security/1.best-practices.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/guides/13.security/1.best-practices.md b/content/guides/13.security/1.best-practices.md index 0210d761e..4ac30fb83 100644 --- a/content/guides/13.security/1.best-practices.md +++ b/content/guides/13.security/1.best-practices.md @@ -119,8 +119,8 @@ The password policy (Settings → Auth → Password Policy) is a regular express Since password validation runs on the main event loop and is performed whenever a password is created or updated (including public registration and password resets) a poorly designed pattern could be exploited remotely to degrade performance or make the instance unresponsive. -- Prefer the built-in presets, which are safe by design. -- If you author a custom pattern, avoid nested quantifiers (`(x+)+`, `(x*)*`) and test it against long, non-matching inputs before deploying. +- Prefer built-in presets whenever possible, as they are safe by design. +- When using a custom regex, avoid nested quantifiers (e.g. `(x+)+`, `(x*)*` etc) and test the pattern against long, non-matching inputs before deploying it. ## Files & Assets