{"record":{"id":"6397564dea8c1169","repo":"flipped-aurora/gin-vue-admin","slug":"d-639756","errorCode":null,"errorMessage":"密码长度不能少于 %d 位","messagePattern":"密码长度不能少于 (.+?) 位","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"server/utils/password_complexity.go","lineNumber":15,"sourceCode":"package utils\n\nimport (\n\t\"fmt\"\n\t\"strings\"\n\t\"unicode\"\n\t\"unicode/utf8\"\n\n\t\"github.com/flipped-aurora/gin-vue-admin/server/model/system\"\n)\n\n// ValidatePasswordComplexity 按安全配置校验密码复杂度 不满足返回可读错误\nfunc ValidatePasswordComplexity(pwd string, cfg system.SysSecurityConfig) error {\n\tif cfg.PwdMinLength > 0 && utf8.RuneCountInString(pwd) < cfg.PwdMinLength {\n\t\treturn fmt.Errorf(\"密码长度不能少于 %d 位\", cfg.PwdMinLength)\n\t}\n\tvar hasUpper, hasLower, hasDigit, hasSpecial bool\n\tfor _, r := range pwd {\n\t\tswitch {\n\t\tcase unicode.IsUpper(r):\n\t\t\thasUpper = true\n\t\tcase unicode.IsLower(r):\n\t\t\thasLower = true\n\t\tcase unicode.IsDigit(r):\n\t\t\thasDigit = true\n\t\tcase unicode.IsPunct(r) || unicode.IsSymbol(r):\n\t\t\thasSpecial = true\n\t\t}\n\t}\n\tvar missing []string\n\tif cfg.PwdRequireUpper && !hasUpper {\n\t\tmissing = append(missing, \"大写字母\")\n\t}","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/flipped-aurora/gin-vue-admin/blob/3136500ef380842b0eb6c4daa87c3f8a47fcf9e0/server/utils/password_complexity.go#L1-L33","documentation":"ValidatePasswordComplexity checks a password against the configured security policy (system.SysSecurityConfig). When cfg.PwdMinLength > 0 and the password has fewer UTF-8 runes than the minimum, it returns \"密码长度不能少于 %d 位\". It is a deliberate, user-facing validation error, not an internal fault.","triggerScenarios":"Calling ValidatePasswordComplexity(pwd, cfg) (directly or via password change/create endpoints) where utf8.RuneCountInString(pwd) < cfg.PwdMinLength.","commonSituations":"Admin sets a stricter minimum (e.g. 8 or 12) in security config while users still submit short passwords; frontend not synced with backend's PwdMinLength; password change APIs called from scripts without the new policy.","solutions":["Use a longer password meeting cfg.PwdMinLength characters.","Check the configured PwdMinLength in system security settings and enforce the same minimum in the frontend form before submit.","If the minimum is unnecessarily strict, adjust PwdMinLength in the security configuration."],"exampleFix":"// before\nValidatePasswordComplexity(\"abc123\", cfg) // fails when cfg.PwdMinLength = 8\n\n// after\npwd := \"Abcdef1!23\"\nif utf8.RuneCountInString(pwd) >= cfg.PwdMinLength {\n    _ = ValidatePasswordComplexity(pwd, cfg)\n}","handlingStrategy":"validation","validationCode":"func pwdLongEnough(pwd string, cfg system.SysSecurityConfig) bool {\n    return cfg.PwdMinLength <= 0 || utf8.RuneCountInString(pwd) >= cfg.PwdMinLength\n}","typeGuard":null,"tryCatchPattern":"if err := utils.ValidatePasswordComplexity(pwd, cfg); err != nil {\n    http.Error(w, err.Error(), http.StatusBadRequest) // message is user-facing\n    return\n}","preventionTips":["Enforce the same PwdMinLength in frontend form validation","Show the configured minimum in the password hint text","Notify users when the security policy tightens","Never hardcode a length check different from the server config"],"tags":["validation","password","security"],"backgroundTag":"password-too-short","analyzedSha":"3136500ef380842b0eb6c4daa87c3f8a47fcf9e0","analyzedAt":"2026-08-31T13:50:02.721Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}