From f9f542bffd9f38189f3c1393475b473f1f0e035e Mon Sep 17 00:00:00 2001
From: Santhosh-CloudB <131965145+Santhosh-CloudB@users.noreply.github.com>
Date: Mon, 27 Nov 2023 15:39:15 +0530
Subject: [PATCH] Added validation of FIPS password length (#8694)

Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
---
 .../java/hudson/security/HudsonPrivateSecurityRealm.java    | 6 ++++++
 core/src/main/resources/hudson/security/Messages.properties | 1 +
 2 files changed, 7 insertions(+)

diff --git a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
index 0331884821..6305a69a6a 100644
--- a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
+++ b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
@@ -114,6 +114,7 @@ import org.springframework.security.crypto.password.PasswordEncoder;
  * @author Kohsuke Kawaguchi
  */
 public class HudsonPrivateSecurityRealm extends AbstractPasswordBasedSecurityRealm implements ModelObject, AccessControlled {
+    private static final int FIPS_PASSWORD_LENGTH = 14;
     private static /* not final */ String ID_REGEX = System.getProperty(HudsonPrivateSecurityRealm.class.getName() + ".ID_REGEX");
 
     /**
@@ -452,6 +453,11 @@ public class HudsonPrivateSecurityRealm extends AbstractPasswordBasedSecurityRea
             si.errors.put("password1", Messages.HudsonPrivateSecurityRealm_CreateAccount_PasswordRequired());
         }
 
+        if (FIPS140.useCompliantAlgorithms()) {
+            if (si.password1.length() < FIPS_PASSWORD_LENGTH) {
+                si.errors.put("password1", Messages.HudsonPrivateSecurityRealm_CreateAccount_FIPS_PasswordLengthInvalid());
+            }
+        }
         if (si.fullname == null || si.fullname.isEmpty()) {
             si.fullname = si.username;
         }
diff --git a/core/src/main/resources/hudson/security/Messages.properties b/core/src/main/resources/hudson/security/Messages.properties
index 697c0f13fd..dee3d09235 100644
--- a/core/src/main/resources/hudson/security/Messages.properties
+++ b/core/src/main/resources/hudson/security/Messages.properties
@@ -36,6 +36,7 @@ HudsonPrivateSecurityRealm.ManageUserLinks.Description=Create/delete/modify user
 
 HudsonPrivateSecurityRealm.CreateAccount.TextNotMatchWordInImage=Text didn''t match the word shown in the image
 HudsonPrivateSecurityRealm.CreateAccount.PasswordNotMatch=Password didn''t match
+HudsonPrivateSecurityRealm.CreateAccount.FIPS.PasswordLengthInvalid=Password must be at least 14 characters long
 HudsonPrivateSecurityRealm.CreateAccount.PasswordRequired=Password is required
 HudsonPrivateSecurityRealm.CreateAccount.UserNameRequired=User name is required
 HudsonPrivateSecurityRealm.CreateAccount.UserNameInvalidCharacters=User name must only contain alphanumeric characters, underscore and dash