* refactor: Address post-merge review feedback from daniel-beck
- Move password complexity classes from hudson.security to jenkins.security
- Fix special character regex: use \p{Punct} instead of [^a-zA-Z0-9]
so spaces and Unicode letters are no longer treated as special chars
- Document special character examples on the config UI
- Add violations list to PasswordComplexityException for better UX
- Remove redundant checkMethod="post" (already the default)
- Move message keys to jenkins/security/Messages.properties
- Update copyright year to 2026
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: Remove unused NonePasswordComplexityRule import
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: Add @Restricted(NoExternalUse.class) to built-in implementations
Plugins only need to extend PasswordComplexityRule — there is no need
to reference BasicPasswordComplexityRule or NonePasswordComplexityRule
directly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: Update @since to acknowledge package move from hudson.security
Per daniel-beck's feedback: document that these classes were originally
added in 2.572 and moved from hudson.security to jenkins.security in
this release, so plugin authors are aware of the breaking change.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
Co-authored-by: Mark Waite <mark.earl.waite@gmail.com>
Fix flaky ProcessTreeTest#processProperlyKilledUnix
Resolves JENKINS-70781 by using a randomly generated sleep duration instead of a hardcoded 100000. This prevents the test from failing when orphaned sleep processes from previous aborted test runs are present in the host system.
* [JENKINS-1963] Clarify time zone used for SCM polling schedule
* Fix Prettier formatting
* Add trailing newline for Prettier
* Update core/src/main/resources/hudson/triggers/SCMTrigger/help.html
Co-authored-by: Mark Waite <mark.earl.waite@gmail.com>
---------
Co-authored-by: Mark Waite <mark.earl.waite@gmail.com>
* [JENKINS-69789] Add configurable password complexity policy to HudsonPrivateSecurityRealm
Jenkins' built-in user database currently has no password complexity
requirements beyond non-empty and encoder limits. This makes it
difficult to meet enterprise security policies.
Add configurable password policy options (minimum length, require
uppercase/lowercase/digit/special character) via @DataBoundSetter
fields on HudsonPrivateSecurityRealm. The policy is enforced on both
user self-registration and admin password changes. All options default
to off for backward compatibility.
Closes#18323
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* [JENKINS-69789] Add password complexity rule extension point
Refactor password complexity validation from hardcoded fields to an
ExtensionPoint architecture. Add PasswordComplexityRule as a new
extension point that allows plugins to contribute custom password
validation strategies.
Include DefaultPasswordComplexityRule as a built-in implementation
with configurable minimum length and character type requirements
(uppercase, lowercase, digit, special character).
The rule is optional and configured via the Security settings UI
using a dropdown selector. When no rule is selected, no extra
password requirements are enforced, preserving backward compatibility.
Closes#18323
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Spotless import ordering violation in Functions.java
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add tests for password change flow with complexity rule
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Refactor PasswordComplexityRule per review feedback
- Remove PasswordComplexityRuleDescriptor, use Descriptor<PasswordComplexityRule>
- Remove getDescriptor() override from PasswordComplexityRule
- Change validate() to void, throw PasswordComplexityException
- Add NonePasswordComplexityRule to avoid null checks
- Use dropdownDescriptorSelector in config.jelly
- Remove getPasswordComplexityRuleDescriptors() from Functions.java
- Change default minimum length from 0 to 8
- Add readResolve() for backward compatibility
- Update tests for new validate() signature
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Remove @Restricted from DataBoundSetter to fix Stapler binding
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Spotless import ordering in HudsonPrivateSecurityRealmTest
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix ATH test failures by setting a default for password complexity rule
When using <f:dropdownDescriptorSelector> for passwordComplexityRule without a default attribute, the UI implicitly selects the first descriptor alphabetically (DefaultPasswordComplexityRule) for new instances. This caused JenkinsDatabaseSecurityRealmTest.login_and_logout in the Acceptance Test Harness to unexpectedly enforce password complexity rules and fail when testing with simple passwords.
This commit explicitly sets the default passwordComplexityRule to NonePasswordComplexityRule via the default attribute in the Jelly UI, preserving the expected default behavior and fixing the ATH failures.
* Refactor password complexity tests per review feedback
- Move pure rule validation tests to core module as lightweight unit tests
(no JenkinsRule needed) in DefaultPasswordComplexityRuleTest
- Add assertions on exception messages to verify user-actionable content
- Add tests for each individual character type requirement
- Add test verifying multiple violations are reported together
- Remove unused assertDoesNotThrow import from integration test
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update core/src/main/resources/hudson/security/DefaultPasswordComplexityRule/config.jelly
Co-authored-by: James Nord <jtnord@users.noreply.github.com>
* Rename DefaultPasswordComplexityRule to BasicPasswordComplexityRule
Avoids confusion with "default" implying it is the default selection
(the actual default is NonePasswordComplexityRule).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add real-time password validation on password change page
- Add doCheckPassword() to Details.DescriptorImpl for AJAX validation
- Change password inputs to f:password tags to enable auto-validation
- Handles Protector-encrypted values gracefully
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Revert real-time password validation on change page
The f:password tag renders as hidden input, breaking existing tests
that expect HtmlPasswordInput. Real-time validation on the password
change page requires a different approach and will be addressed
in a follow-up PR.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fixed test case failure
* test: Address PR review by using allOf for multiple assertions
* feat: Introduce PasswordComplexityRuleDescriptor base type
* fix: Revert all() return type to avoid generic unchecked assignment
* fix: Add @POST to doCheckPassword and fix Spotless formatting
* fix: Replace deprecated getCheckUrl with toStemUrl to fix page nesting
The deprecated getCheckUrl() returns a JavaScript expression that
evaluates to a URL without a query string. When FormChecker.sendRequest
processes a POST request with no '?' in the URL, url.indexOf('?')
returns -1, causing url.substring(0, -1) to produce an empty string.
This makes fetch('') request the current page, whose full HTML response
gets inserted into the validation-error-area, triggering
Behaviour.applySubtree on the new content and causing infinite page
nesting on /user/{username}/security.
Switch to the modern getCheckMethod().toStemUrl() which returns a plain
URL, and add checkDependsOn="" so the frontend takes the modern code
path that correctly appends the field value as a query parameter.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: Add tests for doCheckPassword and null rule fallback
- Test doCheckPassword returns error for weak password
- Test doCheckPassword returns ok for strong password
- Test doCheckPassword returns ok when no rule configured
- Test doCheckPassword returns ok for empty password
- Test setPasswordComplexityRule(null) falls back to NoneRule
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: Move null rule fallback test to integration test module
The setNullPasswordComplexityRuleFallsBackToNone test creates a
HudsonPrivateSecurityRealm instance which requires Jenkins runtime.
Move it from core unit tests to integration tests where JenkinsRule
provides the necessary environment.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: James Nord <jtnord@users.noreply.github.com>
* Update dependency prettier to v3.9.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* Use '</pre>' tag instead of inserting a line break in the tag
---------
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Mark Waite <mark.earl.waite@gmail.com>
Jenkins Release Bot