You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by bt...@apache.org on 2021/09/06 02:16:14 UTC
[james-project] branch master updated: JAMES-3637 JPA
usersRepository should rely on efficient hash functions by default (#623)
This is an automated email from the ASF dual-hosted git repository.
btellier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
The following commit(s) were added to refs/heads/master by this push:
new 72ed51b JAMES-3637 JPA usersRepository should rely on efficient hash functions by default (#623)
72ed51b is described below
commit 72ed51b69f0be613ebbef46270f843fb0ca06dc9
Author: Benoit TELLIER <bt...@linagora.com>
AuthorDate: Mon Sep 6 09:16:07 2021 +0700
JAMES-3637 JPA usersRepository should rely on efficient hash functions by default (#623)
---
.../java/org/apache/james/user/jpa/model/JPAUser.java | 7 +++++--
.../org/apache/james/user/jpa/model/JPAUserTest.java | 6 +++---
upgrade-instructions.md | 19 ++++++++++++++++---
3 files changed, 24 insertions(+), 8 deletions(-)
diff --git a/server/data/data-jpa/src/main/java/org/apache/james/user/jpa/model/JPAUser.java b/server/data/data-jpa/src/main/java/org/apache/james/user/jpa/model/JPAUser.java
index 63215a0..44cbff5 100644
--- a/server/data/data-jpa/src/main/java/org/apache/james/user/jpa/model/JPAUser.java
+++ b/server/data/data-jpa/src/main/java/org/apache/james/user/jpa/model/JPAUser.java
@@ -64,7 +64,7 @@ public class JPAUser implements User {
interface PasswordHashFunction extends Function<String, String> {}
private static PasswordHashFunction chooseHashFunction(String nullableAlgorithm) {
- String algorithm = Optional.ofNullable(nullableAlgorithm).orElse("MD5");
+ String algorithm = Optional.ofNullable(nullableAlgorithm).orElse("SHA-512");
switch (algorithm) {
case "NONE":
return (password) -> "password";
@@ -82,8 +82,11 @@ public class JPAUser implements User {
return Hashing.sha256();
case "SHA-512":
return Hashing.sha512();
- default:
+ case "SHA-1":
+ case "SHA1":
return Hashing.sha1();
+ default:
+ return Hashing.sha512();
}
}
diff --git a/server/data/data-jpa/src/test/java/org/apache/james/user/jpa/model/JPAUserTest.java b/server/data/data-jpa/src/test/java/org/apache/james/user/jpa/model/JPAUserTest.java
index 2e087aa..c09a292 100644
--- a/server/data/data-jpa/src/test/java/org/apache/james/user/jpa/model/JPAUserTest.java
+++ b/server/data/data-jpa/src/test/java/org/apache/james/user/jpa/model/JPAUserTest.java
@@ -52,12 +52,12 @@ class JPAUserTest {
}
@Test
- void hashPasswordShouldSha1WhenRandomString() {
- Assertions.assertThat(JPAUser.hashPassword(RANDOM_PASSWORD, "random")).isEqualTo("05dbbaa7b4bcae245f14d19ae58ef1b80adf3363");
+ void hashPasswordShouldSha512WhenRandomString() {
+ Assertions.assertThat(JPAUser.hashPassword(RANDOM_PASSWORD, "random")).isEqualTo("f9cc82d1c04bb2ce0494a51f7a21d07ac60b6f79a8a55397f454603acac29d8589fdfd694d5c01ba01a346c76b090abca9ad855b5b0c92c6062ad6d93cdc0d03");
}
@Test
void hashPasswordShouldMD5WhenNull() {
- Assertions.assertThat(JPAUser.hashPassword(RANDOM_PASSWORD, null)).isEqualTo("702000e50c9fd3755b8fc20ecb07d1ac");
+ Assertions.assertThat(JPAUser.hashPassword(RANDOM_PASSWORD, null)).isEqualTo("f9cc82d1c04bb2ce0494a51f7a21d07ac60b6f79a8a55397f454603acac29d8589fdfd694d5c01ba01a346c76b090abca9ad855b5b0c92c6062ad6d93cdc0d03");
}
}
\ No newline at end of file
diff --git a/upgrade-instructions.md b/upgrade-instructions.md
index 37ce170..1331aa1 100644
--- a/upgrade-instructions.md
+++ b/upgrade-instructions.md
@@ -22,15 +22,28 @@ Change list:
- [Adding messageId metadata to the Cassandra attachments](#adding-messageid-metadata-to-the-cassandra-attachments)
- [Changes to the enqueuedMails DAO](#changes-to-the-enqueuedmails-dao)
- [Restructure maximum quotas definition](#restructure-maximum-quotas-definition)
-
+
+### Change defaults for JPA UsersRepository hash function
+
+Date 27/08/2021
+
+JIRA: https://issues.apache.org/jira/browse/JAMES-3637
+
+We changed the default algorithm to hash user password with JPA
+with SHA-512 instead of insecure SHA-1 / MD5.
+
+As such, upgrades might result in inability for users to login, unless you
+explicitly configure the unsecure algorithm you were using.
+
+Changing the user password will upgrade them to the newly introduced hashing standards.
+
### Restructure maximum quotas definition
Date 06/08/2021
JIRA: https://issues.apache.org/jira/browse/JAMES-3630
-Concerned product: Distributed James and
-Concerned product: Distributed James Cassandra James server
+Concerned product: Distributed James and Cassandra James server
We restructured maximum global quota in order to store them in a single Cassandra row. This enables to retrieve this
data on a single primary key read, which is important for performance when receiving many emails over SMTP.
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org