Ticket #31772: 31772-with-tests.patch

src/wp-admin/js/password-strength-meter.js

@@ -18 +18 @@
                         if (password1 != password2 && password2 && password2.length > 0)
                                 return 5;
 
-                        var result = zxcvbn( password1, blacklist );
+                        // Analyze the strength of the first part of the password.  The 'zxcvbn' library takes a long time to analyse longer passwords.  This causes the browser UI to freeze.
+                        // @todo Update zxcvbn once it analyzes long passwords quickly.
+                        // @see https://github.com/dropbox/zxcvbn/issues/69
+                        var result = zxcvbn( password1.substr(0, 128), blacklist );
                         return result.score;
                 },
 

tests/qunit/wp-admin/js/password-strength-meter.js

@@ -98 +98 @@
                 ok( jQuery.inArray( 'WordPress', blacklist ) > -1, 'blacklist contains "WordPress" from page title' );
                 ok( jQuery.inArray( 'tests', blacklist ) > -1, 'blacklist contains "tests" from site URL' );
         });
+
+  test( 'only the first part of really long passwords should be checked', function () {
+    function strength(password) {
+      return passwordStrength(password, [], password);
+    }
+
+    function raw(password) {
+      return zxcvbn(password).score;
+    }
+
+    // passwordStrength()'s character limit.
+    var threshold = 128;
+
+    // Create a long string of zero characters.
+    var weak = new Array( 1 + threshold ).join('0');
+
+    // A password that is strong only after the threshold.
+    var strong = ( weak + '1#2!aGcDeee' );
+
+    // Get WP's strength/score, for comparison.
+    var score = strength( strong );
+
+    ok( score === strength( weak ), 'scores of really long passwords match, regardless of anything after the size limit' );
+    ok( score === raw( weak ), 'Zxcvbn gives the same score as WP for the first part of a long password' );
+    ok( score < raw( strong ), 'Zxcvbn gives a better score than WP for a password which is strong only after the size limit' );
+  });
 });