Password validation can be improved

[READ] Step 1: Are you in the right place?

Yes :)

[REQUIRED] Step 2: Describe your environment

• Operating System version: OSX 10.14.4
• Firebase SDK version: 7.3.0
• Library version: 6.9.1
• Firebase Product: auth

>> firebase --version
6.9.1

[REQUIRED] Step 3: Describe the problem

The password check of admin.auth().createUser(...) does not consider a password value of "undefined". If the password is undefined, the user will be created without any problems.

In my opinion a undefined string should throw an error as well.

Steps to reproduce:

Take the code from below and set different values for the constant value "myPassword" and run it with "npm yourscriptname.js".

Test cases:

Value of myPassword	Result	Expected result?
a string longer than 6 characters	no error	yes
a 6 character string	no error	yes
a string shorter than 6 characters	error	yes
an empty string ("")	error	yes
null	error	yes
undefined	no error	no

Relevant Code:

const admin = require("firebase-admin");

// FIXME Please change file location
const serviceAccount = require("./config/firebase-adminsdk.json");

admin.initializeApp({
 credential: admin.credential.cert(serviceAccount),
 // FIXME Please change URL
 databaseURL: "https://a-sample-project.firebaseio.com"
});

const myPassword = undefined; // enter values here

const user = {
 email: "a.person@testcase.com",
 emailVerified: false,
 password: myPassword,
 displayName: "A nice test person",
 disabled: false
};

admin
 .auth()
 .createUser(user)
 .then(userRecord => {
 console.log(userRecord);
 })
 .catch(error => {
 const e = error.errorInfo;
 console.log(JSON.stringify(e));
 });

If the password does not match the password rules of Firebase the following error will be shown (catch case):

{
 "code": "auth/invalid-password",
 "message":" The password must be a string with at least 6 characters."
}

[hiranya911]

Password is optional for user accounts. Therefore it's perfectly valid to create a user account without any password. Our validation therefore triggers only when something other than undefined is specified as a password.