You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by ta...@apache.org on 2021/01/18 14:08:50 UTC
[myfaces] branch 3.0.x updated: prefer secureRandom over random
fixed code warnings
This is an automated email from the ASF dual-hosted git repository.
tandraschko pushed a commit to branch 3.0.x
in repository https://gitbox.apache.org/repos/asf/myfaces.git
The following commit(s) were added to refs/heads/3.0.x by this push:
new 3cb5387 prefer secureRandom over random fixed code warnings
new b83b591 Merge pull request #148 from bohmber/MYFACES-4373
3cb5387 is described below
commit 3cb538733ba5bc9ddc2da136fb3943fc0c83cead
Author: Bernd Bohmann <bo...@apache.org>
AuthorDate: Sat Jan 16 16:44:51 2021 +0100
prefer secureRandom over random
fixed code warnings
---
.../viewstate/ClientSideStateCacheImpl.java | 14 +-
.../push/cdi/WebsocketChannelTokenBuilderBean.java | 175 ++++++++++-----------
2 files changed, 94 insertions(+), 95 deletions(-)
diff --git a/impl/src/main/java/org/apache/myfaces/application/viewstate/ClientSideStateCacheImpl.java b/impl/src/main/java/org/apache/myfaces/application/viewstate/ClientSideStateCacheImpl.java
index 8772e91..dad7270 100644
--- a/impl/src/main/java/org/apache/myfaces/application/viewstate/ClientSideStateCacheImpl.java
+++ b/impl/src/main/java/org/apache/myfaces/application/viewstate/ClientSideStateCacheImpl.java
@@ -58,13 +58,13 @@ class ClientSideStateCacheImpl extends StateCache<Object, Object>
String csrfRandomMode = WebConfigParamUtils.getStringInitParameter(facesContext.getExternalContext(),
RANDOM_KEY_IN_CSRF_SESSION_TOKEN_PARAM,
RANDOM_KEY_IN_CSRF_SESSION_TOKEN_PARAM_DEFAULT);
- if (RANDOM_KEY_IN_CSRF_SESSION_TOKEN_SECURE_RANDOM.equals(csrfRandomMode))
+ if (RANDOM_KEY_IN_CSRF_SESSION_TOKEN_RANDOM.equals(csrfRandomMode))
{
- csrfSessionTokenFactory = new SecureRandomCsrfSessionTokenFactory(facesContext);
+ csrfSessionTokenFactory = new RandomCsrfSessionTokenFactory(facesContext);
}
else
{
- csrfSessionTokenFactory = new RandomCsrfSessionTokenFactory(facesContext);
+ csrfSessionTokenFactory = new SecureRandomCsrfSessionTokenFactory(facesContext);
}
stateTokenProcessor = new ClientSideStateTokenProcessor();
@@ -95,7 +95,7 @@ class ClientSideStateCacheImpl extends StateCache<Object, Object>
//If no timestamp, state is invalid.
return null;
}
- long passedTime = (System.currentTimeMillis() - timeStamp.longValue()) / 60000;
+ long passedTime = (System.currentTimeMillis() - timeStamp) / 60000;
if (passedTime > clientViewStateTimeout)
{
@@ -137,9 +137,9 @@ class ClientSideStateCacheImpl extends StateCache<Object, Object>
public Object encodeSerializedState(FacesContext facesContext,
Object serializedView)
{
- Object[] state = null;
+ Object[] state;
- if (getClientViewStateTimeout(facesContext.getExternalContext()).longValue() > 0L)
+ if (getClientViewStateTimeout(facesContext.getExternalContext()) > 0L)
{
state = new Object[3];
state[TIMESTAMP_PARAM] = System.currentTimeMillis();
@@ -188,7 +188,7 @@ class ClientSideStateCacheImpl extends StateCache<Object, Object>
_clientViewStateTimeout = WebConfigParamUtils.getLongInitParameter(
context, INIT_PARAM_CLIENT_VIEW_STATE_TIMEOUT,
INIT_PARAM_CLIENT_VIEW_STATE_TIMEOUT_DEFAULT);
- if (_clientViewStateTimeout.longValue() < 0L)
+ if (_clientViewStateTimeout < 0L)
{
_clientViewStateTimeout = 0L;
}
diff --git a/impl/src/main/java/org/apache/myfaces/push/cdi/WebsocketChannelTokenBuilderBean.java b/impl/src/main/java/org/apache/myfaces/push/cdi/WebsocketChannelTokenBuilderBean.java
index 0ce1a28..a57f4f1 100644
--- a/impl/src/main/java/org/apache/myfaces/push/cdi/WebsocketChannelTokenBuilderBean.java
+++ b/impl/src/main/java/org/apache/myfaces/push/cdi/WebsocketChannelTokenBuilderBean.java
@@ -1,88 +1,87 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.myfaces.push.cdi;
-
-import jakarta.annotation.PostConstruct;
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.faces.context.FacesContext;
-import org.apache.myfaces.buildtools.maven2.plugin.builder.annotation.JSFWebConfigParam;
-import org.apache.myfaces.shared.util.WebConfigParamUtils;
-
-/**
- *
- */
-@ApplicationScoped
-public class WebsocketChannelTokenBuilderBean
-{
- /**
- * Defines how to generate the csrf session token.
- */
- @JSFWebConfigParam(since="2.2.0", expectedValues="secureRandom, random",
- defaultValue="none", group="state")
- private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_PARAM
- = "org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN";
- private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_PARAM_DEFAULT = "random";
-
- private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_SECURE_RANDOM = "secureRandom";
- private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_RANDOM = "random";
-
- private CsrfSessionTokenFactory csrfSessionTokenFactory;
-
- private boolean initialized;
-
- public WebsocketChannelTokenBuilderBean()
- {
- }
-
- @PostConstruct
- public void init()
- {
- FacesContext facesContext = FacesContext.getCurrentInstance();
- if (facesContext != null)
- {
- internalInit(facesContext);
- }
- }
-
- private synchronized void internalInit(FacesContext facesContext)
- {
- String csrfRandomMode = WebConfigParamUtils.getStringInitParameter(facesContext.getExternalContext(),
- RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_PARAM,
- RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_PARAM_DEFAULT);
- if (RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_SECURE_RANDOM.equals(csrfRandomMode))
- {
- csrfSessionTokenFactory = new SecureRandomCsrfSessionTokenFactory(facesContext);
- }
- else
- {
- csrfSessionTokenFactory = new RandomCsrfSessionTokenFactory(facesContext);
- }
- initialized=true;
- }
-
- public String createChannelToken(FacesContext facesContext, String channel)
- {
- if (!initialized)
- {
- internalInit(facesContext);
- }
- return csrfSessionTokenFactory.createCryptographicallyStrongTokenFromSession(facesContext);
- }
-}
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.myfaces.push.cdi;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.faces.context.FacesContext;
+import org.apache.myfaces.buildtools.maven2.plugin.builder.annotation.JSFWebConfigParam;
+import org.apache.myfaces.shared.util.WebConfigParamUtils;
+
+/**
+ *
+ */
+@ApplicationScoped
+public class WebsocketChannelTokenBuilderBean
+{
+ /**
+ * Defines how to generate the csrf session token.
+ */
+ @JSFWebConfigParam(since="2.2.0", expectedValues="secureRandom, random",
+ defaultValue="secureRandom", group="state")
+ private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_PARAM
+ = "org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN";
+
+ private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_SECURE_RANDOM = "secureRandom";
+ private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_RANDOM = "random";
+ private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_PARAM_DEFAULT = RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_SECURE_RANDOM;
+ private CsrfSessionTokenFactory csrfSessionTokenFactory;
+
+ private boolean initialized;
+
+ public WebsocketChannelTokenBuilderBean()
+ {
+ }
+
+ @PostConstruct
+ public void init()
+ {
+ FacesContext facesContext = FacesContext.getCurrentInstance();
+ if (facesContext != null)
+ {
+ internalInit(facesContext);
+ }
+ }
+
+ private synchronized void internalInit(FacesContext facesContext)
+ {
+ String csrfRandomMode = WebConfigParamUtils.getStringInitParameter(facesContext.getExternalContext(),
+ RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_PARAM,
+ RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_PARAM_DEFAULT);
+ if (RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_RANDOM.equals(csrfRandomMode))
+ {
+ csrfSessionTokenFactory = new RandomCsrfSessionTokenFactory(facesContext);
+ }
+ else
+ {
+ csrfSessionTokenFactory = new SecureRandomCsrfSessionTokenFactory(facesContext);
+ }
+ initialized=true;
+ }
+
+ public String createChannelToken(FacesContext facesContext, String channel)
+ {
+ if (!initialized)
+ {
+ internalInit(facesContext);
+ }
+ return csrfSessionTokenFactory.createCryptographicallyStrongTokenFromSession(facesContext);
+ }
+}