1
\$\begingroup\$

This takes a user password, hashes password to SHA1 and does a check against the Pwnedpasswords database.

I know I need to use unwrap less and do more real checking to improve the clarity of errors. In what other places is my code lacking and what should I learn or look at to improve in the future.

The current resources I am using are the Rust by Example. The documentation for the crates I used and in general looking at rust code on GitHub.

$ cargo run --bin checker -- check
Password: *********
Password is (not) compromised

#[macro_use] extern crate clap;
extern crate crypto;
extern crate reqwest;
extern crate regex;
extern crate rpassword;

use crypto::digest::Digest;
use crypto::sha1::Sha1;
use clap::App;
use regex::Regex;

/* loads clap cli config
 * if the check subcommand is used, run check
 */
fn main () {
    let yaml = load_yaml!("config/clap_cli.yml");
    let matches = App::from_yaml(yaml).get_matches();

    if let Some(_m_check) = matches.subcommand_matches("check") {
        check();
    }

}

/* get password from user
 * hash the password
 * check against pwned database
 * tell user if the password is bad
 */
fn check () {
    let value = &rpassword::prompt_password_stdout("Password: ")
        .unwrap();
    let mut hasher = Sha1::new();

    hasher.input_str(value);
    let pass_hash = hasher.result_str().to_uppercase();
    let pass_hash_slice = pass_hash.get(0..5).unwrap();
    let pass_hash_end = pass_hash.get(5..).unwrap();


    let body = reqwest::get(
        &format!("https://api.pwnedpasswords.com/range/{}", pass_hash_slice)
        ).unwrap().text().unwrap();

    let re_pass = Regex::new(&pass_hash_end).unwrap();

    if re_pass.is_match(&body) {
        println!("Password is compromised.");
    } else {
        println!("Password is not compromised.");
    }
}
\$\endgroup\$
  • 1
    \$\begingroup\$ You should erase the clear password from memory as soon as possible. \$\endgroup\$ – Stargateur Mar 17 at 7:35
  • \$\begingroup\$ Thank you Stargateur for the input, I will learn how to do that and implement it in future iterations. And also keep it in mind as well for future projects that handle sensitive data. \$\endgroup\$ – furcb Mar 17 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.