Password

[ehooo]

Proposed solution for #386 with re

[ehooo]

@sigmavirus24 I also fix a bug on this rule on python2 (d90eecf) when the param is a list, for example:
def my_funct((a, b))
Shall I create a test on example file?

[lukehinds]

I like the idea of using regex here, but with this current patch I don't think it adds a great deal - its just the same list as before, but using re. instead of a python list.

However I think it would be really nice to have the option of providing the list externally so users could supply there own. Something like [0] maybe - although that list might not be a good example as it would cause performance issues.

[0] https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt

So an external list would be sourced and fed into re.compile (or if no list is present just use the defaults in the code). Perhaps the list could be configured in the config parser, if its present (true) then load the list, if not (false) use the defaults.

What do you think?

[ehooo]

Hi @lukehinds I like your idea, however the flow that you describe I think should be a new requirement out of this rule.

[lukehinds]

@ehooo understood if you would like to work on that, please go ahead and raise it as an enhancement.