{"record":{"id":"ae8cc8d1cbf9e8a3","repo":"Billionmail/BillionMail","slug":"password-length-must-be-at-least-4-characters","errorCode":null,"errorMessage":"password length must be at least 4 characters","messagePattern":"password length must be at least 4 characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/internal/controller/settings/settings.go","lineNumber":202,"sourceCode":"func validateConfigValue(key, value string) error {\n\t// Basic length check\n\tif len(value) > 1024 {\n\t\treturn fmt.Errorf(\"configuration value too long, maximum 1024 characters\")\n\t}\n\n\tswitch key {\n\tcase \"ADMIN_USERNAME\", \"admin_username\":\n\t\t// Admin username: allowed letters, numbers, underscores, length 4-32\n\t\tif len(value) < 4 || len(value) > 32 {\n\t\t\treturn fmt.Errorf(\"admin username length must be between 4-32\")\n\t\t}\n\t\tif !public.IsValidUsername(value) {\n\t\t\treturn fmt.Errorf(\"admin username can only contain letters, numbers and underscores\")\n\t\t}\n\n\tcase \"ADMIN_PASSWORD\", \"admin_password\":\n\t\tif len(value) < 4 {\n\t\t\treturn fmt.Errorf(\"password length must be at least 4 characters\")\n\t\t}\n\n\tcase \"BILLIONMAIL_HOSTNAME\", \"billionmail_hostname\":\n\t\t// Hostname: allowed letters, numbers, dots, hyphens\n\t\tif !public.IsValidHostname(value) {\n\t\t\treturn fmt.Errorf(\"hostname format is incorrect\")\n\t\t}\n\n\tcase \"SMTP_PORT\", \"SMTPS_PORT\", \"SUBMISSION_PORT\", \"IMAP_PORT\", \"IMAPS_PORT\", \"POP_PORT\", \"POPS_PORT\", \"HTTP_PORT\", \"HTTPS_PORT\", \"REDIS_PORT\",\n\t\t\"smtp\", \"smtps\", \"submission\", \"imap\", \"imaps\", \"pop\", \"pops\", \"http\", \"https\", \"redis_port\":\n\t\t// Port: 1-65535\n\t\tport := public.ParseInt(value)\n\t\tif port < 1 || port > 65535 {\n\t\t\treturn fmt.Errorf(\"port must be between 1-65535\")\n\t\t}\n\n\tcase \"IPV4_NETWORK\", \"ipv4_network\":\n\t\t// IPv4 network: CIDR format","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/controller/settings/settings.go#L184-L220","documentation":"For the ADMIN_PASSWORD key, validateConfigValue requires a minimum length of 4 bytes; shorter passwords are rejected. There is no maximum enforced here beyond the global 1024 limit. This is a weak minimum, so treat it as a floor, not a policy.","triggerScenarios":"SetSystemConfig/SetSystemConfigKey with ADMIN_PASSWORD/admin_password whose value length is 0-3 characters.","commonSituations":"Automated provisioning scripts setting placeholder passwords like 'pw'; truncated values from env parsing; users intentionally choosing tiny test passwords.","solutions":["Set a password of at least 4 characters (prefer a strong 12+ character secret)","Check your automation/env for truncation before calling the API","Prefer generated secrets rather than hand-set short test passwords","Run the same len(value) >= 4 check client-side before submit"],"exampleFix":"// before\nsetConfig(\"ADMIN_PASSWORD\", \"abc\") // rejected\n// after\nsetConfig(\"ADMIN_PASSWORD\", \"S3cure-Passphrase!\")","handlingStrategy":"validation","validationCode":"function isValidPassword(p) {\n  return typeof p === 'string' && p.length >= 4;\n}","typeGuard":"function isAcceptablePassword(v: unknown): v is string {\n  return typeof v === 'string' && v.length >= 4;\n}","tryCatchPattern":null,"preventionTips":["Require min length 4 (recommend 12+) in password forms","Disable empty/short submissions client-side","Check for truncation when reading from env/config","Never ship placeholder passwords in automation"],"tags":["validation","admin","password","settings"],"backgroundTag":"config-value-validation-failed","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}