You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by bo...@apache.org on 2021/01/13 22:45:11 UTC
[myfaces] branch 3.0.x updated: MYFACES-4373: make sure
SecureRandom is used for invalid configs
This is an automated email from the ASF dual-hosted git repository.
bommel pushed a commit to branch 3.0.x
in repository https://gitbox.apache.org/repos/asf/myfaces.git
The following commit(s) were added to refs/heads/3.0.x by this push:
new 81bd798 MYFACES-4373: make sure SecureRandom is used for invalid configs
new 62d31e4 Merge pull request #133 from wtlucy/secureRandom2_3.0.x
81bd798 is described below
commit 81bd7986bfe09ac37f0a051d1f60f7a0a8d4700c
Author: Bill Lucy <wt...@gmail.com>
AuthorDate: Wed Jan 13 16:48:02 2021 -0500
MYFACES-4373: make sure SecureRandom is used for invalid configs
---
.../application/viewstate/ServerSideStateCacheImpl.java | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/impl/src/main/java/org/apache/myfaces/application/viewstate/ServerSideStateCacheImpl.java b/impl/src/main/java/org/apache/myfaces/application/viewstate/ServerSideStateCacheImpl.java
index 47fcaf7..5c3cbc0 100644
--- a/impl/src/main/java/org/apache/myfaces/application/viewstate/ServerSideStateCacheImpl.java
+++ b/impl/src/main/java/org/apache/myfaces/application/viewstate/ServerSideStateCacheImpl.java
@@ -206,22 +206,22 @@ class ServerSideStateCacheImpl extends StateCache<Object, Object>
{
log.warning(RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN_PARAM + " \""
+ randomMode + "\" is not supported (anymore)."
- + " Fallback to \"random\"");
+ + " Fallback to \"secureRandom\"");
}
sessionViewStorageFactory = new RandomSessionViewStorageFactory(
- new RandomKeyFactory(facesContext));
+ new SecureRandomKeyFactory(facesContext));
}
String csrfRandomMode = WebConfigParamUtils.getStringInitParameter(facesContext.getExternalContext(),
RANDOM_KEY_IN_CSRF_SESSION_TOKEN_PARAM,
RANDOM_KEY_IN_CSRF_SESSION_TOKEN_PARAM_DEFAULT);
- if (RANDOM_KEY_IN_CSRF_SESSION_TOKEN_SECURE_RANDOM.equals(csrfRandomMode))
+ if (RANDOM_KEY_IN_CSRF_SESSION_TOKEN_RANDOM.equals(csrfRandomMode))
{
- csrfSessionTokenFactory = new SecureRandomCsrfSessionTokenFactory(facesContext);
+ csrfSessionTokenFactory = new RandomCsrfSessionTokenFactory(facesContext);
}
else
{
- csrfSessionTokenFactory = new RandomCsrfSessionTokenFactory(facesContext);
+ csrfSessionTokenFactory = new SecureRandomCsrfSessionTokenFactory(facesContext);
}
stateTokenProcessor = new ServiceSideStateTokenProcessor();