better password checking

Author: WeylonSantana

Intersect (Core)/Security/PasswordUtils.cs

@@ -9,4 +9,7 @@ public static string ComputePasswordHash(string password)
     {
         return BitConverter.ToString(SHA256.HashData(Encoding.UTF8.GetBytes(password ?? string.Empty))).Replace("-", string.Empty);
     }
+
+    public static bool IsValidClientPasswordHash(string? hashToValidate) =>
+            hashToValidate is { Length: 64 } && hashToValidate.All(char.IsAsciiHexDigit);
 }

Intersect.Server/Web/RestApi/Routes/V1/UserController.cs

@@ -2,6 +2,7 @@
 using System.Text.RegularExpressions;
 using Intersect.Enums;
 using Intersect.GameObjects;
+using Intersect.Security;
 using Intersect.Server.Collections.Indexing;
 using Intersect.Server.Collections.Sorting;
 using Intersect.Server.Database;
@@ -99,7 +100,7 @@ public IActionResult RegisterUser([FromBody] UserInfoRequestBody user)
                 return BadRequest($@"Invalid username '{user.Username}'.");
             }
 
-            if (!Regex.IsMatch(user.Password?.ToUpperInvariant()?.Trim(), "^[0-9A-Fa-f]{64}$", RegexOptions.Compiled))
+            if (PasswordUtils.IsValidClientPasswordHash(user.Password))
             {
                 return BadRequest(@"Did not receive a valid password.");
             }
@@ -390,7 +391,7 @@ public IActionResult ValidatePassword(LookupKey lookupKey, [FromBody] PasswordVa
                 return BadRequest(@"No password provided.");
             }
 
-            if (!Regex.IsMatch(data.Password?.ToUpperInvariant()?.Trim(), "^[0-9A-Fa-f]{64}$", RegexOptions.Compiled))
+            if (PasswordUtils.IsValidClientPasswordHash(data.Password))
             {
                 return BadRequest(@"Did not receive a valid password.");
             }