SonarSource/sonarqube · error · PasswordException

%s

Error message

%s

What it means

ChangePasswordAction.assertPasswordFormatIsValid enforces the configured password policy: minimum length plus at least one uppercase, one lowercase, one digit, and one special character. Each failing checkArgument's message is caught and rethrown as a PasswordException carrying the reason, returned to the caller (HTTP 400 with the specific policy message).

Solutions

1. Generate a password satisfying all rules (length >= MIN_PASSWORD_LENGTH, upper+lower+digit+special)
2. Read the PasswordException message to see which specific rule failed
3. Update client-side validation to mirror the server policy

Example fix

// before
newPassword = "abc123"                  // no uppercase/special
// after
newPassword = "Abc123!xyz"             // satisfies all rules

function meetsPolicy(p) {
  return p.length >= 8 && /[A-Z]/.test(p) && /[a-z]/.test(p) && /\d/.test(p) && /[^A-Za-z0-9]/.test(p);
}
if (!meetsPolicy(newPassword)) throw new Error('Password violates policy');

try { await changePassword(login, old, newPw); } catch (e) { if (e instanceof PasswordException && /Password must/.test(e.message)) { promptUserWithRule(e.message); } else throw e; }

When it happens

Trigger: POST api/users/change_password (or api/users/change_password for self) where the new_password parameter violates any rule: too short, or missing uppercase/lowercase/digit/special character.

Common situations: Automation generating passwords with limited character sets; UIs with older/weaker validation than the server; users choosing passwords below MIN_PASSWORD_LENGTH.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• new_password_same_as_old
• old_password_incorrect
• The ' ' parameter is missing
• a JVM option can't be empty and must start with '-'. The…
• Address contains invalid character: 0x%02x

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/36a0f3c4a7f8fa32. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/user/ws/ChangePasswordAction.java:177

      writeJsonResponse(badRequestException.getMessage(), response);
      LOG.debug(badRequestException.getMessage(), badRequestException);
    } catch (PasswordException passwordException) {
      LOG.debug(passwordException.getMessage(), passwordException);
      setResponseStatus(response, HTTP_BAD_REQUEST);
      String message = passwordException.getPasswordMessage().map(pm -> pm.key).orElseGet(passwordException::getMessage);
      writeJsonResponse(message, response);
    }
  }

  private static void assertPasswordFormatIsValid(String newPassword) throws PasswordException {
    try {
      checkArgument(newPassword.length() >= MIN_PASSWORD_LENGTH, "Password must be at least %s characters long", MIN_PASSWORD_LENGTH);
      checkArgument(UPPERCASE_PATTERN.matcher(newPassword).find(), "Password must contain at least one uppercase character");
      checkArgument(LOWERCASE_PATTERN.matcher(newPassword).find(), "Password must contain at least one lowercase character");
      checkArgument(DIGIT_PATTERN.matcher(newPassword).find(), "Password must contain at least one digit");
      checkArgument(SPECIAL_CHARACTER_PATTERN.matcher(newPassword).find(), "Password must contain at least one special character");
    } catch (IllegalArgumentException e) {
      throw new PasswordException(e.getMessage());
    }
  }

  private static String getParamOrThrow(HttpRequest request, String key) throws PasswordException {
    String value = request.getParameter(key);
    if (isNullOrEmpty(value)) {
      throw new PasswordException(format(MSG_PARAMETER_MISSING, key));
    }
    return value;
  }

  private void checkPreviousPassword(DbSession dbSession, UserDto user, String password) throws PasswordException {
    try {
      localAuthentication.authenticate(dbSession, user, password, AuthenticationEvent.Method.BASIC);
    } catch (AuthenticationException ex) {
      throw new PasswordException(OLD_PASSWORD_INCORRECT, "Incorrect password");
    }
  }

View on GitHub (pinned to 184c821202)