BCryptPasswordEncoder validates strength

Fixes gh-3862

crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java

@@ -15,12 +15,12 @@
  */
 package org.springframework.security.crypto.bcrypt;
 
-import static org.assertj.core.api.Assertions.*;
-
 import org.junit.Test;
 
 import java.security.SecureRandom;
 
+import static org.assertj.core.api.Assertions.assertThat;
+
 /**
  * @author Dave Syer
  *
@@ -57,6 +57,16 @@ public class BCryptPasswordEncoderTests {
 		assertThat(encoder.matches("password", result)).isTrue();
 	}
 
+	@Test(expected = IllegalArgumentException.class)
+	public void badLowCustomStrength() {
+		new BCryptPasswordEncoder(3);
+	}
+
+	@Test(expected = IllegalArgumentException.class)
+	public void badHighCustomStrength() {
+		new BCryptPasswordEncoder(32);
+	}
+
 	@Test
 	public void customRandom() {
 		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(8, new SecureRandom());