From bdb2f90e649e6c6025fa58b0fd8ff8ccec207992 Mon Sep 17 00:00:00 2001
From: ai-anant <ant2010in@gmail.com>
Date: Fri, 14 Aug 2026 22:48:19 +0000
Subject: [PATCH] feat(java): detect passwords truncated to 72 bytes before
 BCrypt (CWE-916)

---
 .../crypto/bcrypt-truncated-password.yaml     | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 java/jenkins/crypto/bcrypt-truncated-password.yaml

diff --git a/java/jenkins/crypto/bcrypt-truncated-password.yaml b/java/jenkins/crypto/bcrypt-truncated-password.yaml
new file mode 100644
index 0000000..520fce7
--- /dev/null
+++ b/java/jenkins/crypto/bcrypt-truncated-password.yaml
@@ -0,0 +1,31 @@
+rules:
+  - id: codevigilant.java.jenkins.crypto.bcrypt-truncated-password
+    message: >-
+      A password byte array is truncated to 72 bytes (Arrays.copyOfRange(..., 0,
+      72) or a BCRYPT/MAX_LENGTH constant) before being hashed or compared with
+      BCrypt. BCrypt only uses the first 72 bytes of the input, so truncating
+      first makes every password that shares its first 72 bytes equivalent
+      (password-equivalence) and silently weakens long credentials. Hash or
+      compare the full password and let the library apply its own limit, or
+      pre-hash long passwords with a fast digest (e.g. SHA-256) before BCrypt.
+    severity: HIGH
+    languages: [java]
+    patterns:
+      - pattern: Arrays.copyOfRange($BYTES, 0, $LEN)
+      - metavariable-regex:
+          metavariable: $LEN
+          regex: '^(72|.*MAX_LENGTH.*|.*BCRYPT.*)$'
+    metadata:
+      category: security
+      cwe: "CWE-916: Use of Password Hash With Insufficient Computational Effort"
+      owasp: "A02:2021 - Cryptographic Failures"
+      technology:
+        - jenkins
+        - java
+        - crypto
+      confidence: MEDIUM
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+        - https://en.wikipedia.org/wiki/Bcrypt
+      source: ai-anant
+      license: MIT