Fix TypeError when JSON login password is a non-string value

flask_security/forms.py

@@ -561,6 +561,12 @@ def validate(self, **kwargs: t.Any) -> bool:
             return False
 
         assert self.password.data is not None  # validator password_required
+        if not isinstance(self.password.data, str):
+            # e.g. a JSON body can set this to a dict/list/number - DataRequired()
+            # only checks truthiness, and passing that on crashes hash_password()/
+            # normalize() below instead of failing validation.
+            self.password.errors.append(get_message("INVALID_PASSWORD")[0])
+            return False
         # Stay clear of accessing 'username' unless we added that field.
         # Lots of applications have added their own.
         # To make subclassing easier - if self.ifield has been set we assume

tests/test_basic.py

@@ -689,6 +689,15 @@ def test_invalid_json_auth(client):
     assert b'"code": 400' in response.data
 
 
+def test_non_string_json_password_auth(client):
+    # A JSON body can set password to a non-string (e.g. a dict) - used to crash.
+    data = dict(email="matt@lp.com", password={"not": "a string"})
+    response = client.post(
+        "/login?include_auth_token", content_type="application/json", json=data
+    )
+    assert b'"code": 400' in response.data
+
+
 def test_token_auth_via_querystring_valid_token(client):
     response = json_authenticate(client)
     token = response.json["response"]["user"]["authentication_token"]