Bug: forceOccurrenceOfEachType does not behave as expected

[jshergal]

When setting forceOccurrenceOfEachType to true the expectation would be that the resultant random string will contain at least 1 character from each of the specified character classes. Due to the current implementation, this behavior is not guaranteed. It is "likely" given a small set of character classes and a long enough string, but it does not guarantee it.

On a related note, the current unit tests around this functionality do not expose this flaw as they only use a single regular expression to verify that the strings are of the expected length and contain only the characters from the specified classes, but they do not check to ensure that there is at least 1 character from each class within the resultant string. The unit tests should be updated to additionally check for a single occurrence of each character class within the string. For example, to ensure there is at least 1 lowercase letter:
Regex.IsMatch(randomString, @"[a-z]");

As an example of the bug, I made a small update to the test ValidateForceOccurrenceForAlphaNumericLowercaseWithCustomSymbols() to check for all character classes. Two of the resulting strings failed the test:
"ik^omn@$xyk$&&hc@%$a"
"*@lz#@g@a^#wkh^p^%h!"

The expectation with forceOccurrenceOfEachType would be that those strings would also contain a digit, but they did not. Out of 1000 strings these were the only two that did not, but it shows that while it is highly likely to receive a string that follows the setting, it is not guaranteed.

[ljnath]

@jshergal , As you rightly pointed out, the expectation for this flag is that at least one character of each type should be included. However, depending on the input, it may fail to generate a high number of combinations with smaller inputs.

Thank you for highlighting this limitation in the unit test. Please feel free to make any improvements; I’d be happy to incorporate them.

[jshergal]

Hi @ljnath,
I have both updated the unit tests as well as fixed the bug in my own repo, you can take a look at both the issue (which I duplicated there) as well as the check-in that fixed the issue.

Issue:
jshergal/StuceSoftware.RandomStringGenerator#3

Code changes:
jshergal/StuceSoftware.RandomStringGenerator@d257859

Within the unit tests, pay attention to the regular expressions, for example, this one:
@"^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[*&^%$#@!])[a-zA-Z0-9*&^%$#@!]{20}$"
It validates that the string is 20 characters long, but also requires that there is at least one lowercase letter ((?=.*[a-z]), one uppercase ((?=.*[A-Z])), one digit ((?=.*[0-9])) and one custom symbol ((?=.*[*&^%$#@!])). You will see there are similar regexes in the unit tests that deal with the other combinations.

In the code I made a change to first assert that the maxLength is at least equal to the number of input character classes, then subtract that length off of the max length. Insert randomly as before, except that the length is now x characters less. Then finally for each character class, insert 1 randomly chosen character at a randomly chosen index in the string. This guarantees the existence of at least 1 character from each character class.

Another approach you could take would be to create a char array of the required length, insert 1 random char from each class into the first x array locations, then proceed as normal, and finally shuffle the array before returning it as a string. I haven't benchmarked anything, so you would want to check that out yourself to see what works better.