[jira] [Resolved] (SHIRO-302) DefaultHasher does not generate random salt

["Kalle Korhonen (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SHIRO-302?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Kalle Korhonen resolved SHIRO-302.
----------------------------------

       Resolution: Fixed
    Fix Version/s: 1.2.0

Applied, thanks!

> DefaultHasher does not generate random salt
> -------------------------------------------
>
>                 Key: SHIRO-302
>                 URL: https://issues.apache.org/jira/browse/SHIRO-302
>             Project: Shiro
>          Issue Type: Bug
>          Components: Cryptography & Hashing
>            Reporter: Maria Jurcovicova
>            Assignee: Kalle Korhonen
>             Fix For: 1.2.0
>
>         Attachments: patch-defaulthasher.patch
>
>   Original Estimate: 1h
>  Remaining Estimate: 1h
>
> Extract from DefaultHasher javadoc: When a salt is not specified in a request, this implementation generates secure random salts via its {@link #setRandomNumberGenerator(org.apache.shiro.crypto.RandomNumberGenerator) randomNumberGenerator} property.
> Random salt is generated, but never assigned (line 155):
>         if (publicSaltBytes == null) {
>             getRandomNumberGenerator().nextBytes().getBytes();
>         }

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira