You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shenyu.apache.org by "2252603132 (via GitHub)" <gi...@apache.org> on 2024/02/04 11:45:10 UTC
[PR] Encrypt the password [shenyu]
2252603132 opened a new pull request, #5436:
URL: https://github.com/apache/shenyu/pull/5436
encrypt shenyu-admin login password #5255
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "2252603132 (via GitHub)" <gi...@apache.org>.
2252603132 commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1931516402
> 本主题还涉及客户端元信息注册登录。
Can you be more specific?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "wlngo (via GitHub)" <gi...@apache.org>.
wlngo commented on code in PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#discussion_r1512183906
##########
shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java:
##########
@@ -152,6 +158,8 @@ public void closeRepository() {
}
}
+
Review Comment:
好的
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#discussion_r1485863046
##########
shenyu-sync-data-center/shenyu-sync-data-http/src/main/java/org/apache/shenyu/sync/data/http/AccessTokenManager.java:
##########
@@ -132,6 +141,30 @@
}
}
+ /** aes encrypt data.
+ *
+ * @param secretKeyStr secretKeyStr
+ * @param ivStr ivStr
+ * @param data data
+ */
+ private String encrypt(final String secretKeyStr, final String ivStr, final String data) {
+ String encryptStr;
+ byte[] secretKeyBytes = secretKeyStr.getBytes();
+ byte[] ivBytes = ivStr.getBytes();
+ try {
+ SecretKey secretKey = new SecretKeySpec(secretKeyBytes, "AES");
+ IvParameterSpec ivParameterSpec = new IvParameterSpec(ivBytes);
+ Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
Review Comment:
## Use of a broken or risky cryptographic algorithm
Cryptographic algorithm [AES/CBC/PKCS5Padding](1) is weak and should not be used.
[Show more details](https://github.com/apache/shenyu/security/code-scanning/53)
##########
shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java:
##########
@@ -152,6 +162,31 @@
}
}
+
+ /** aes encrypt data.
+ *
+ * @param secretKeyStr secretKeyStr
+ * @param ivStr ivStr
+ * @param data data
+ */
+ private String encrypt(final String secretKeyStr, final String ivStr, final String data) {
+ String encryptStr;
+ byte[] secretKeyBytes = secretKeyStr.getBytes();
+ byte[] ivBytes = ivStr.getBytes();
+ try {
+ SecretKey secretKey = new SecretKeySpec(secretKeyBytes, "AES");
+ IvParameterSpec ivParameterSpec = new IvParameterSpec(ivBytes);
+ Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
Review Comment:
## Use of a broken or risky cryptographic algorithm
Cryptographic algorithm [AES/CBC/PKCS5Padding](1) is weak and should not be used.
[Show more details](https://github.com/apache/shenyu/security/code-scanning/52)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind commented on code in PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#discussion_r1512160142
##########
shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java:
##########
@@ -152,6 +158,8 @@ public void closeRepository() {
}
}
+
Review Comment:
remove this
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind commented on code in PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#discussion_r1495256174
##########
shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DashboardUserServiceImpl.java:
##########
@@ -319,7 +337,25 @@ public boolean checkUserPassword(final String userId) {
return true;
}
-
+
+ private String aesDecodePassword(final String password) {
+ String encodedPassword = null;
+ try {
+ String key = secretProperties.getKey();
+ String iv = secretProperties.getIv();
+ Cipher cipher = Cipher.getInstance("AES/CTR/NoPadding");
+ SecretKey secretKey = new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "AES");
+ IvParameterSpec ivParameterSpec = new IvParameterSpec(iv.getBytes(StandardCharsets.UTF_8));
+ cipher.init(Cipher.DECRYPT_MODE, secretKey, ivParameterSpec);
+ byte[] decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(password));
+ encodedPassword = new String(decryptedBytes);
+ } catch (Exception e) {
+ LOG.error("AES decode error", e);
Review Comment:
throw exception include message
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1953507597
the password of the database should be encrypted
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "wlngo (via GitHub)" <gi...@apache.org>.
wlngo commented on code in PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#discussion_r1512183906
##########
shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java:
##########
@@ -152,6 +158,8 @@ public void closeRepository() {
}
}
+
Review Comment:
好的
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1926279482
add my wechat: yijia1949
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "li-keguo (via GitHub)" <gi...@apache.org>.
li-keguo commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1965670067
> the password of the database should be encrypted
The database password change needs to be compatible with upgrade and downgrade scenarios. I think another topic can be used to change the database password.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "2252603132 (via GitHub)" <gi...@apache.org>.
2252603132 commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1926283228
I have added
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "li-keguo (via GitHub)" <gi...@apache.org>.
li-keguo commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1933436979
> > 本主题还涉及客户端元信息注册登录。
> > Can you be more specific?
see:
https://github.com/apache/shenyu/blob/master/shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1926253923
do you test this pr?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#discussion_r1477709042
##########
shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DashboardUserServiceImpl.java:
##########
@@ -319,7 +332,25 @@
return true;
}
-
+
+ private String AESDecodePassword(final String password){
+ String encodedPassword = null;
+ try {
+ String key = secretProperties.getKey();
+ String iv = secretProperties.getIv();
+ Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
Review Comment:
## Use of a broken or risky cryptographic algorithm
Cryptographic algorithm [AES/CBC/PKCS5Padding](1) is weak and should not be used.
[Show more details](https://github.com/apache/shenyu/security/code-scanning/51)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1965953578
need to change
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind merged PR #5436:
URL: https://github.com/apache/shenyu/pull/5436
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "2252603132 (via GitHub)" <gi...@apache.org>.
2252603132 commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1926276346
yes in h2 database
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1933448649
## [Codecov](https://app.codecov.io/gh/apache/shenyu/pull/5436?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
Attention: `3 lines` in your changes are missing coverage. Please review.
> Comparison is base [(`85c2509`)](https://app.codecov.io/gh/apache/shenyu/commit/85c25094d61bfa2787472cf0a4163fa90bf7c6d8?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) 61.14% compared to head [(`99250ee`)](https://app.codecov.io/gh/apache/shenyu/pull/5436?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) 61.07%.
| [Files](https://app.codecov.io/gh/apache/shenyu/pull/5436?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [...u/admin/service/impl/DashboardUserServiceImpl.java](https://app.codecov.io/gh/apache/shenyu/pull/5436?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c2hlbnl1LWFkbWluL3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9zaGVueXUvYWRtaW4vc2VydmljZS9pbXBsL0Rhc2hib2FyZFVzZXJTZXJ2aWNlSW1wbC5qYXZh) | 85.00% | [2 Missing and 1 partial :warning: ](https://app.codecov.io/gh/apache/shenyu/pull/5436?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #5436 +/- ##
============================================
- Coverage 61.14% 61.07% -0.08%
+ Complexity 8652 8645 -7
============================================
Files 1258 1258
Lines 38375 38392 +17
Branches 3670 3671 +1
============================================
- Hits 23466 23447 -19
- Misses 12799 12827 +28
- Partials 2110 2118 +8
```
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/shenyu/pull/5436?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Encrypt the password [shenyu]
Posted by "li-keguo (via GitHub)" <gi...@apache.org>.
li-keguo commented on PR #5436:
URL: https://github.com/apache/shenyu/pull/5436#issuecomment-1931138015
This topic also involves client meta-information registration login.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org