code: private boolean matchesPreviousPasswords(String password, String username,
              int historySize) {
  
          // No need to compare if no history is relevant
          if (historySize <= 0)
              return false;
  
          // Check password against all recorded hashes
          List<PasswordRecordModel> history = passwordRecordMapper.select(username, historySize);
          for (PasswordRecordModel record : history) {
  
              byte[] hash = encryptionService.createPasswordHash(password, record.getPasswordSalt());
              if (Arrays.equals(hash, record.getPasswordHash()))
                  return true;
              
          }
  
          // No passwords match
          return false;
          
      }
docs: Returns whether the given password matches any of the user's previous
  passwords. Regardless of the value specified here, the maximum number of
  passwords involved in this check depends on how many previous passwords
  were actually recorded, which depends on the password policy.
  
  @param password
  The password to check.
  
  @param username
  The username of the user whose history should be compared against
  the given password.
  
  @param historySize
  The maximum number of history records to compare the password
  against.
  
  @return
  true if the given password matches any of the user's previous
  passwords, up to the specified limit, false otherwise.