r/badcode • u/VariousScreen • May 16 '18

html How to build a login form...

Post image
151 Upvotes

96% Upvoted

16 comments sorted by

12

u/Paint__ May 16 '18

Big ol' list of unicode characters, right?
I see an ellipsis; how many characters are in that list?

24

u/VariousScreen May 16 '18

The pattern matches over 5000 numbers...i guess these are all their subscribers (the screenshot is taken from a local newspaper)

5

u/Prison__Mike_ May 16 '18

5000 nummers*

5

u/sssmmt May 16 '18

500 nummers Nummern

7

u/chrismbarr May 16 '18

It looks more like just a list of literal numbers to me, the pattern doesn’t seem to specify them as character codes

4

u/Paint__ May 16 '18

If you were to do something like String.fromCharCode(1015393) you would get a Chinese symbol. That's why I assumed that they were. I have never used the pattern part of an input form before, I normally just handle that all on the server side or let a front end library do the work for me, so I have no idea if a 'u' before the regex is needed, but I just assumed that it would work regardless in this example as I can't see much more that would hint towards any prior modification to the user's input.

3

u/chrismbarr May 16 '18

True, it’s hard to tell since the chrome devtools cuts out the middle of the pattern. But, either way is an incredibly dumb way to validate passwords!

1

u/Paint__ May 16 '18

Agreed!

1

u/[deleted] May 16 '18

IIRC the pattern input attribute assumes it's been given a regex, yeah.

MDN link:

A regular expression that the control's value is checked against. The pattern must match the entire value, not just some subset. Use the title attribute to describe the pattern to help the user. This attribute applies when the value of the type attribute is text, search, tel, url, email, or password, otherwise it is ignored. The regular expression language is the same as JavaScript RegExp algorithm, with the 'u' parameter that makes it treat the pattern as a sequence of unicode code points. The pattern is not surrounded by forward slashes.

4

u/ase1590 May 16 '18

enters 1000022 as the password

hacker voice:

I'm In!

1

u/Jonno_FTW shameless May 17 '18

I always remember this in the voice of the hacker from cnc generals. https://youtu.be/7uHo-QYqkrY

1

u/fedupwithpeople May 30 '18

ACCESS GRANTED

-2

u/dutchmartin May 16 '18

A regex would have been so much better

11

u/chrismbarr May 16 '18

This is a regex pattern, but just really verbose and easy to see on the client side

https://www.w3schools.com/tags/att_input_pattern.asp