bug6104: adding zxcvbn-1.9.0 to target platform

java/com.sap.sailing.targetplatform.base/features/target-base/feature.xml

@@ -498,4 +498,18 @@
          version="4.28.3"
          unpack="false"/>
 
+   <plugin
+         id="com.nulabinc.zxcvbn"
+         download-size="0"
+         install-size="0"
+         version="1.9.0"
+         unpack="false"/>
+
+   <plugin
+         id="com.nulabinc.zxcvbn.source"
+         download-size="0"
+         install-size="0"
+         version="1.9.0"
+         unpack="false"/>
+
 </feature>

java/com.sap.sse.feature.runtime/feature.xml

@@ -1381,4 +1381,21 @@
          install-size="0"
          version="5.12.1.v20221103-2317"
          unpack="false"/>
+
+   <plugin
+         id="com.nulabinc.zxcvbn"
+         feature="true"
+         download-size="0"
+         install-size="0"
+         version="1.9.0"
+         unpack="false"/>
+
+   <plugin
+         id="com.nulabinc.zxcvbn.source"
+         feature="true"
+         download-size="0"
+         install-size="0"
+         version="1.9.0"
+         unpack="false"/>
+
 </feature>

java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java

@@ -1079,7 +1079,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
         }
         if (username == null || username.length() < 3) {
             throw new UserManagementException(UserManagementException.USERNAME_DOES_NOT_MEET_REQUIREMENTS);
-        } else if (password == null || password.length() < 5) {
+        } else if (isPasswordGoodEnough(password)) {
             throw new UserManagementException(UserManagementException.PASSWORD_DOES_NOT_MEET_REQUIREMENTS);
         }
         RandomNumberGenerator rng = new SecureRandomNumberGenerator();
@@ -1098,6 +1098,10 @@ implements ReplicableSecurityService, ClearStateTestSupport {
         updateSimpleUserEmail(username, email, validationBaseURL);
         return result;
     }
+
+    private boolean isPasswordGoodEnough(String password) {
+        return password == null || password.length() < 5;
+    }
     
     /**
      * Checks if the {@code clientIP} is currently blocked for user creation, and if so, throws a
@@ -1183,7 +1187,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
     }
 
     private void updateSimpleUserPassword(final User user, String newPassword) throws UserManagementException {
-        if (newPassword == null || newPassword.length() < 5) {
+        if (isPasswordGoodEnough(newPassword)) {
             throw new UserManagementException(UserManagementException.PASSWORD_DOES_NOT_MEET_REQUIREMENTS);
         }
         // for non-admins, check that the old password is correct