feat(java): detect passwords truncated to 72 bytes before BCrypt (CWE-916)

java/jenkins/crypto/bcrypt-truncated-password.yaml

@@ -0,0 +1,31 @@
+rules:
+  - id: codevigilant.java.jenkins.crypto.bcrypt-truncated-password
+    message: >-
+      A password byte array is truncated to 72 bytes (Arrays.copyOfRange(..., 0,
+      72) or a BCRYPT/MAX_LENGTH constant) before being hashed or compared with
+      BCrypt. BCrypt only uses the first 72 bytes of the input, so truncating
+      first makes every password that shares its first 72 bytes equivalent
+      (password-equivalence) and silently weakens long credentials. Hash or
+      compare the full password and let the library apply its own limit, or
+      pre-hash long passwords with a fast digest (e.g. SHA-256) before BCrypt.
+    severity: HIGH
+    languages: [java]
+    patterns:
+      - pattern: Arrays.copyOfRange($BYTES, 0, $LEN)
+      - metavariable-regex:
+          metavariable: $LEN
+          regex: '^(72|.*MAX_LENGTH.*|.*BCRYPT.*)$'
+    metadata:
+      category: security
+      cwe: "CWE-916: Use of Password Hash With Insufficient Computational Effort"
+      owasp: "A02:2021 - Cryptographic Failures"
+      technology:
+        - jenkins
+        - java
+        - crypto
+      confidence: MEDIUM
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+        - https://en.wikipedia.org/wiki/Bcrypt
+      source: ai-anant
+      license: MIT