[BUG-PA-002][FR-03][POST /api/reset-password] Endpoint accepts weak, missing, null, and non-string passwords

[AkiraTomori]

Summary

POST /api/reset-password accepts invalid newPassword classes and reports successful password reset instead of rejecting them.

• Severity: High
• Environment: Local Docker eshop-sut-backend-1
• HW06 Pool: Pool A / FR-03
• Failed cases: FR03-DOM-028 through FR03-DOM-036

Preconditions

A disposable registered account has a fresh valid recovery token.

Steps to reproduce

1. Obtain a fresh token with POST /api/forgot-password.
2. Send POST /api/reset-password with the matching email/token and an invalid password, such as a seven-character value.
3. Repeat independently for missing uppercase, lowercase, digit, allowed special character; disallowed-only #; missing, null, and numeric newPassword.
4. Use a fresh token for every case.

Expected result

Each request is rejected and the account password remains unchanged. The exact error status/schema is unspecified.

Actual result

All nine requests returned HTTP 200 with {"message":"Password reset successfully"}.

Impact

Weak or malformed credentials can be installed through password recovery, bypassing the password policy inherited from FR-01.

Evidence

• 23127379_Homework/HW6/Pool-A_FR03_Password_Reset/postman/newman/Pool-A_FR03_report.json
• 23127379_Homework/HW6/Pool-A_FR03_Password_Reset/postman/newman/Pool-A_FR03_report.html
• 23127379_Homework/HW6/Pool-A_FR03_Password_Reset/evidence/Pool-A_FR03_newman-cli.txt
• Screenshot generated from the redacted FR03-DOM-028 failure with MSSV 23127379.

Requirement sources: README FR-03 → FR-01; API specification §1.4
Suggested labels: bug, security, validation, FR-03, api

[AkiraTomori]

HW06 screenshot evidence — MSSV 23127379

Repository source: BUG-PA-002_23127379.png

The screenshot summarizes the redacted Newman/fixture evidence recorded in the HW06 Pool artifacts; it does not expose OTPs, passwords, tokens, or personal email addresses.