Django 1.9 "Common Password Validator" - Strange Behaviour
<p>I'm attempting to replace the built in <code>common-passwords.txt.gz</code> file, which supposedly contains the top 1,000 common passwords, with my own identical version which contains the top 10,000 common passwords for my country, but I've encountered some rather strange behaviour.</p>

<ol>
<li><p>Firstly I directly substituted Django's <code>common-passwords.txt.gz</code> file (4KB) with my own containing my .txt file with the same utf-8 encoding as Django (which comes in at 34KB), then restarted the test server. When changing a users password to "password" it does not raise the expected error as it does with Django's common password file.</p>

<p>The first line of both the built in password list and my new one begins <code>123456password12345678qwerty123456789...</code> so it clearly should do. </p>

<p>When I append a few extra passwords to their common-passwords file it appears to work as it should and raise an error if I try to use them as passwords, so I don't think that it's cached somewhere or anything like that.</p>

<p>Is there some kind of built in file size limit for the common password list or for the <code>gzip.open(password_list_path).read().decode('utf-8').splitlines()</code> function? </p></li>
<li><p>Secondly, trying to figure out the above led me to a strange bug. Using Django's built in <code>common-passwords.txt.gz</code> (of which the first line starts <code>123456password12345678qwerty123456789...</code>) successfully raises a validation error for "password" and "password1", but not for "password12" or "password123"!</p>

<p>As I read it, the Django validation code basically checks if the submitted password <code>is in</code> each line from the common passwords file, and I cannot find any code that exempts passwords above a certain length from the validation. Am I missing something or is this a bug?</p></li>
</ol>

<p>The "common password validation" function in Django 1.9 is found in <code>\venv\Lib\site-packages\django\contrib\auth\password_validation.py</code>, the relevant class is below:</p>

<pre><code>class CommonPasswordValidator(object):
"""
Validate whether the password is a common password.

The password is rejected if it occurs in a provided list, which may be gzipped.
The list Django ships with contains 1000 common passwords, created by Mark Burnett:
https://xato.net/passwords/more-top-worst-passwords/
"""
    DEFAULT_PASSWORD_LIST_PATH = os.path.join(
        os.path.dirname(os.path.realpath(upath(__file__))), 'common-passwords.txt.gz'
    )

    def __init__(self, password_list_path=DEFAULT_PASSWORD_LIST_PATH):
        try:
            common_passwords_lines = gzip.open(password_list_path).read().decode('utf-8').splitlines()
        except IOError:
            with open(password_list_path) as f:
                common_passwords_lines = f.readlines()

        self.passwords = {p.strip() for p in common_passwords_lines}

    def validate(self, password, user=None):
        if password.lower().strip() in self.passwords:
            raise ValidationError(
                _("This password is too common (it would be trivial to crack!)"),
                code='password_too_common',
            )

    def get_help_text(self):
        return _("Your password can't be a commonly used password.")
</code></pre>