fix(password-policies): sanitize and validate forbidRepeatingCharactersCount before constructing RegExp

Summary

In @rocket.chat/password-policies, forbidRepeatingCharactersCount is directly interpolated into a RegExp string constructor without input validation or type sanitization.

Location

packages/password-policies/src/PasswordPolicy.ts (lines 80-95)

Problem Description

If forbidRepeatingCharactersCount receives an invalid option (e.g., negative values like -1, NaN, or non-integer inputs passed via settings/configuration), new RegExp('(.)\\1{-1,}') throws an uncaught SyntaxError: Invalid regular expression.

// Current Implementation:
this.regex = {
    forbiddingRepeatingCharacters: new RegExp(`(.)\\1{${forbidRepeatingCharactersCount},}`),
};

Proposed Fix

Sanitize forbidRepeatingCharactersCount before constructing the regex to ensure it is a valid integer >= 1, falling back gracefully to the default count (3) if invalid:

const safeForbidRepeatingCharactersCount =
    typeof forbidRepeatingCharactersCount === 'number' && Number.isInteger(forbidRepeatingCharactersCount) && forbidRepeatingCharactersCount >= 1
        ? forbidRepeatingCharactersCount
        : 3;

this.regex = {
    forbiddingRepeatingCharacters: new RegExp(`(.)\\1{${safeForbidRepeatingCharactersCount},}`),
    // ...
};

Pull Request

A fix has been created locally on branch fix/password-policy-regex-validation with full unit test coverage.

Start in packages/password-policies/src/PasswordPolicy.ts at lines 80-95 and inspect how forbidRepeatingCharactersCount reaches the RegExp constructor. Validate invalid values with the stated fallback of 3, then run the package’s unit tests and confirm coverage for negative, NaN, and non-integer inputs.