{"record":{"id":"10bcbc698232324b","repo":"testcontainers/testcontainers-java","slug":"password-can-be-up-to-128-characters-long-10bcbc","errorCode":null,"errorMessage":"Password can be up to 128 characters long","messagePattern":"Password can be up to 128 characters long","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/mssqlserver/src/main/java/org/testcontainers/mssqlserver/MSSQLServerContainer.java","lineNumber":137,"sourceCode":"\n    @Override\n    public MSSQLServerContainer withPassword(final String password) {\n        checkPasswordStrength(password);\n        this.password = password;\n        return self();\n    }\n\n    private void checkPasswordStrength(String password) {\n        if (password == null) {\n            throw new IllegalArgumentException(\"Null password is not allowed\");\n        }\n\n        if (password.length() < 8) {\n            throw new IllegalArgumentException(\"Password should be at least 8 characters long\");\n        }\n\n        if (password.length() > 128) {\n            throw new IllegalArgumentException(\"Password can be up to 128 characters long\");\n        }\n\n        long satisfiedCategories = Stream\n            .of(PASSWORD_CATEGORY_VALIDATION_PATTERNS)\n            .filter(p -> p.matcher(password).find())\n            .count();\n\n        if (satisfiedCategories < 3) {\n            throw new IllegalArgumentException(\n                \"Password must contain characters from three of the following four categories:\\n\" +\n                \" - Latin uppercase letters (A through Z)\\n\" +\n                \" - Latin lowercase letters (a through z)\\n\" +\n                \" - Base 10 digits (0 through 9)\\n\" +\n                \" - Non-alphanumeric characters such as: exclamation point (!), dollar sign ($), number sign (#), \" +\n                \"or percent (%).\"\n            );\n        }\n    }","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/mssqlserver/src/main/java/org/testcontainers/mssqlserver/MSSQLServerContainer.java#L119-L155","documentation":"The legacy org.testcontainers.mssqlserver.MSSQLServerContainer caps passwords at 128 characters in checkPasswordStrength(), throwing IllegalArgumentException for longer values, since SQL Server itself rejects passwords beyond this limit.","triggerScenarios":"Calling withPassword() with a String longer than 128 characters on the legacy container class.","commonSituations":"Auto-generated long secrets passed as passwords; secrets-manager values pasted without truncation.","solutions":["Use a password of 128 characters or fewer","Generate a shorter dedicated sa password","Truncate or validate before calling withPassword()"],"exampleFix":"// before\ncontainer.withPassword(longGeneratedSecret); // 250 chars\n// after\nString pw = longGeneratedSecret.substring(0, 128);\ncontainer.withPassword(pw);","handlingStrategy":"validation","validationCode":"if (password != null && password.length() > 128) { throw new IllegalArgumentException(\"Password must be at most 128 characters\"); }","typeGuard":null,"tryCatchPattern":"try { container.withPassword(pw); } catch (IllegalArgumentException e) { throw new IllegalStateException(\"SA password too long: \" + e.getMessage(), e); }","preventionTips":["Truncate or shorten generated secrets before use","Validate password length in test fixture builders"],"tags":["testcontainers","mssql","password","validation"],"backgroundTag":"value-out-of-range","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}