{"record":{"id":"7b664860f70d8718","repo":"Budibase/budibase","slug":"project-package-password-is-too-long","errorCode":null,"errorMessage":"Project package password is too long.","messagePattern":"Project package password is too long\\.","errorType":"validation","errorClass":"HTTPError","httpStatus":400,"severity":"error","filePath":"packages/server/src/sdk/workspace/projects/backups/imports.ts","lineNumber":921,"sourceCode":"\n  if (failedId) {\n    throw new HTTPError(\n      `Project import failed while saving '${failedId}'.`,\n      400\n    )\n  }\n}\n\nasync function extractProjectPackage(\n  file: { path: string },\n  encryptPassword?: string\n): Promise<ExtractedProjectPackage> {\n  const fileStats = await fsp.stat(file.path)\n  if (fileStats.size > MAX_ARCHIVE_SIZE_BYTES) {\n    throw new HTTPError(\"Project package is too large.\", 400)\n  }\n  if (encryptPassword && encryptPassword.length > MAX_ENCRYPT_PASSWORD_LENGTH) {\n    throw new HTTPError(\"Project package password is too long.\", 400)\n  }\n\n  await validateProjectPackageBeforeExtraction(file)\n  const tmpPath = await untarFile(file)\n  try {\n    if (encryptPassword) {\n      try {\n        await decryptFiles(tmpPath, encryptPassword)\n      } catch {\n        throw new HTTPError(\"Project package could not be decrypted.\", 400)\n      }\n    }\n\n    const packageFiles = await readDirectoryRecursively(tmpPath)\n    const rootEntries = await fsp.readdir(tmpPath)\n    if (rootEntries.some(entry => entry.endsWith(\".enc\")) && !encryptPassword) {\n      throw new HTTPError(\n        \"Files are encrypted but no password has been supplied.\",","sourceCodeStart":903,"sourceCodeEnd":939,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/server/src/sdk/workspace/projects/backups/imports.ts#L903-L939","documentation":"When importing an encrypted project package, the supplied password is checked against MAX_ENCRYPT_PASSWORD_LENGTH (1024 characters, imports.ts:70). If encryptPassword.length exceeds that, extraction is refused up front with HTTP 400. It is a sanity limit on the password field, not a wrong-password error.","triggerScenarios":"Passing an encryptPassword query/body parameter longer than 1024 characters to the project import endpoint, hitting the check at imports.ts:921 in extractProjectPackage().","commonSituations":"Accidentally passing a whole key/certificate or base64 blob as the password; a client bug concatenating values into the password field; misconfigured secret injection that appends newlines or multiple values.","solutions":["Re-run the import with the original password used at export time (it will be well under 1024 chars)","Check the client/CI configuration so the password field receives only the password, not a key file or wrapped secret","Trim stray whitespace/newlines that secret managers often append to injected values"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"function validateEncryptPassword(password?: string): string | undefined {\n  const MAX = 1024\n  if (password && password.length > MAX) {\n    throw new Error(`encryptPassword must be <= ${MAX} characters`)\n  }\n  return password?.trim() || undefined\n}","typeGuard":"function isValidPasswordLength(p: unknown): p is string {\n  return typeof p === 'string' && p.length > 0 && p.length <= 1024\n}","tryCatchPattern":"try {\n  await importProjectPackage(file, password)\n} catch (err) {\n  if (err instanceof HTTPError && err.status === 400 && err.message === 'Project package password is too long.') {\n    // fix the password source (config/CI secret) before retrying\n  } else {\n    throw err\n  }\n}","preventionTips":["Pass only the actual password string, never key files or base64 blobs","Trim secrets loaded from env vars/config to remove appended newlines","Keep export/import passwords under a sane length (e.g. 64 chars)","Review CI templates for accidental concatenation into the password field"],"tags":["encryption","password","http-400","validation"],"backgroundTag":"invalid-parameter","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}