Strength response pattern of bruteforce not handled.

Working on it..

Thanks for the patch, but I'm not sure the try-catch approach is the best solution here.

Problem with empty catch block

The empty catch block means users won't see any error message when their password triggers a bruteforce pattern (or other unhandled patterns). They won't understand why their password is being rejected.

Better approach

We should handle all pattern types explicitly. Looking at the Zxcvbn library, these patterns exist:
- bruteforce (this is what causes the error)
- date
- dictionary
- digit
- regex
- repeat
- sequence
- spatial
- year

We should add the missing ones to both match expressions (lines 121 and 132):

  'bruteforce' => t('Your password is too weak'),
  'regex' => t('Your password must not match a common pattern'),
  default => t('Your password is too weak'),

This way users get proper feedback about their password, and we're safe if Zxcvbn adds new pattern types in the future.

I have added the solution i have produce this issue and update the solution and now the WSOD error solved.

MR !4 works as expected tested on:
php: 8.3
drupal core: 11.2
better_passwords: 2.2.1

When using the password t1234567 during testing, the site crashed. The patch in comment #4 fixed the problem for me.

Core version: 10.5.8
PHP version: 8.3.27
MySQL version: 8.4.5
better_passwords: 2.2.1

I also tried MR #4, but found this to be a less clean solution, as with the patch the user gets feedback on the problem.

However, when using the changes from the MR, just an empty password warning is printed.

This shows up as an empty list item between the possible problems with the password (see screenshot).

I don't know enough to tell if the error I am receiving is related to this issue or if it's a new issue, so please let me know if I should create a new issue.

I am seeing a lot of these messages in watchdog.

UnhandledMatchError: Unhandled match case '...' in better_passwords_validate() (line 132 of /web/modules/contrib/better_passwords/better_passwords.module).

Does this look like the same issue?

I had UnhandledMatchError: Unhandled match case 'bruteforce' error. Patch #4 fixed the issue. Thanks

Following up on #9 (dtfabio):
MR !4 correctly adds 'bruteforce' => NULL and default => NULL to the match expressions, but since the result is immediately assigned via $matches[] = match(...), the NULL still gets pushed into the array. When implode() renders the error list, it produces an empty <li></li> bullet.

The fix is to add array_filter() to strip null values before building the error message. The attached patch combines the bruteforce/default handling from MR !4 with this fix, applied against the 2.x branch.

I'm attaching a patch against the current dev version (with MR !4 already applied).

I also encountered this problem. The patch in #12 solved it for me.