You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2016/04/29 20:54:49 UTC
svn commit: r1741684 - in /ofbiz/trunk:
applications/accounting/src/org/ofbiz/accounting/payment/
applications/accounting/src/org/ofbiz/accounting/thirdparty/ideal/
applications/accounting/src/org/ofbiz/accounting/thirdparty/valuelink/
framework/base/s...
Author: jleroux
Date: Fri Apr 29 18:54:49 2016
New Revision: 1741684
URL: http://svn.apache.org/viewvc?rev=1741684&view=rev
Log:
Changes for "Use SecureRandom instead of Random where appropriate, and randomUUID for externalKey" - https://issues.apache.org/jira/browse/OFBIZ-7028
Because using SecureRandom comes with a cost, I have identified the places where it's reasonable to keep the non secured Random (like tests, internal sequences, etc.).
Ant to use UUID.randomUUID to generate the external link id
Also, though there are no real proven vulnerabilities, I decided to backport as much as possible since it's now public.
Modified:
ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/payment/GiftCertificateServices.java
ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/ideal/IdealEvents.java
ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/valuelink/ValueLinkApi.java
ofbiz/trunk/framework/base/src/org/ofbiz/base/crypto/HashCrypt.java
ofbiz/trunk/framework/entity/src/org/ofbiz/entity/util/EntityCrypto.java
ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/LoginWorker.java
ofbiz/trunk/specialpurpose/ldap/src/org/ofbiz/ldap/cas/OFBizCasAuthenticationHandler.java
Modified: ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/payment/GiftCertificateServices.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/payment/GiftCertificateServices.java?rev=1741684&r1=1741683&r2=1741684&view=diff
==============================================================================
--- ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/payment/GiftCertificateServices.java (original)
+++ ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/payment/GiftCertificateServices.java Fri Apr 29 18:54:49 2016
@@ -19,6 +19,7 @@
package org.ofbiz.accounting.payment;
import java.math.BigDecimal;
+import java.security.SecureRandom;
import java.sql.Timestamp;
import java.util.HashMap;
import java.util.List;
@@ -1443,7 +1444,7 @@ public class GiftCertificateServices {
length = 19;
}
- Random rand = new Random();
+ Random rand = new SecureRandom();
boolean isValid = false;
StringBuilder number = null;
while (!isValid) {
Modified: ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/ideal/IdealEvents.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/ideal/IdealEvents.java?rev=1741684&r1=1741683&r2=1741684&view=diff
==============================================================================
--- ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/ideal/IdealEvents.java (original)
+++ ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/ideal/IdealEvents.java Fri Apr 29 18:54:49 2016
@@ -158,7 +158,7 @@ public class IdealEvents {
transaction.setDescription(orderDescription);
String returnURL = merchantReturnURL + "?orderId=" + orderId;
- Random random = new Random();
+ Random random = new SecureRandom();
String EntranceCode = Long.toString(Math.abs(random.nextLong()), 36);
transaction.setEntranceCode(EntranceCode);
transaction.setMerchantReturnURL(returnURL);
Modified: ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/valuelink/ValueLinkApi.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/valuelink/ValueLinkApi.java?rev=1741684&r1=1741683&r2=1741684&view=diff
==============================================================================
--- ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/valuelink/ValueLinkApi.java (original)
+++ ofbiz/trunk/applications/accounting/src/org/ofbiz/accounting/thirdparty/valuelink/ValueLinkApi.java Fri Apr 29 18:54:49 2016
@@ -29,6 +29,7 @@ import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
+import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
import java.text.SimpleDateFormat;
import java.util.Date;
@@ -579,7 +580,7 @@ public class ValueLinkApi {
// 8 bytes random data
byte[] random = new byte[8];
- Random ran = new Random();
+ Random ran = new SecureRandom();
ran.nextBytes(random);
@@ -825,7 +826,7 @@ public class ValueLinkApi {
}
protected byte[] getRandomBytes(int length) {
- Random rand = new Random();
+ Random rand = new SecureRandom();
byte[] randomBytes = new byte[length];
rand.nextBytes(randomBytes);
return randomBytes;
Modified: ofbiz/trunk/framework/base/src/org/ofbiz/base/crypto/HashCrypt.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/base/src/org/ofbiz/base/crypto/HashCrypt.java?rev=1741684&r1=1741683&r2=1741684&view=diff
==============================================================================
--- ofbiz/trunk/framework/base/src/org/ofbiz/base/crypto/HashCrypt.java (original)
+++ ofbiz/trunk/framework/base/src/org/ofbiz/base/crypto/HashCrypt.java Fri Apr 29 18:54:49 2016
@@ -23,7 +23,7 @@ import static org.ofbiz.base.util.UtilIO
import java.io.UnsupportedEncodingException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
-import java.util.Random;
+import java.security.SecureRandom;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.binary.Hex;
@@ -124,7 +124,7 @@ public class HashCrypt {
hashType = "SHA";
}
if (salt == null) {
- salt = RandomStringUtils.random(new Random().nextInt(15) + 1, CRYPT_CHAR_SET);
+ salt = RandomStringUtils.random(new SecureRandom().nextInt(15) + 1, CRYPT_CHAR_SET);
}
StringBuilder sb = new StringBuilder();
sb.append("$").append(hashType).append("$").append(salt).append("$");
Modified: ofbiz/trunk/framework/entity/src/org/ofbiz/entity/util/EntityCrypto.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/entity/src/org/ofbiz/entity/util/EntityCrypto.java?rev=1741684&r1=1741683&r2=1741684&view=diff
==============================================================================
--- ofbiz/trunk/framework/entity/src/org/ofbiz/entity/util/EntityCrypto.java (original)
+++ ofbiz/trunk/framework/entity/src/org/ofbiz/entity/util/EntityCrypto.java Fri Apr 29 18:54:49 2016
@@ -19,20 +19,20 @@
package org.ofbiz.entity.util;
import java.io.IOException;
+import java.security.Key;
import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
import java.util.Random;
import java.util.concurrent.Callable;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;
-import java.security.Key;
-
import org.apache.commons.codec.binary.Base64;
import org.apache.shiro.crypto.AesCipherService;
import org.apache.shiro.crypto.OperationMode;
+import org.apache.shiro.crypto.hash.DefaultHashService;
import org.apache.shiro.crypto.hash.HashRequest;
import org.apache.shiro.crypto.hash.HashService;
-import org.apache.shiro.crypto.hash.DefaultHashService;
import org.ofbiz.base.crypto.DesCrypt;
import org.ofbiz.base.crypto.HashCrypt;
import org.ofbiz.base.util.Debug;
@@ -44,8 +44,8 @@ import org.ofbiz.entity.Delegator;
import org.ofbiz.entity.EntityCryptoException;
import org.ofbiz.entity.GenericEntityException;
import org.ofbiz.entity.GenericValue;
-import org.ofbiz.entity.transaction.TransactionUtil;
import org.ofbiz.entity.model.ModelField.EncryptMethod;
+import org.ofbiz.entity.transaction.TransactionUtil;
public final class EntityCrypto {
@@ -413,7 +413,7 @@ public final class EntityCrypto {
byte[] saltBytes;
switch (encryptMethod) {
case SALT:
- Random random = new Random();
+ Random random = new SecureRandom();
// random length 5-16
saltBytes = new byte[5 + random.nextInt(11)];
random.nextBytes(saltBytes);
Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/LoginWorker.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/LoginWorker.java?rev=1741684&r1=1741683&r2=1741684&view=diff
==============================================================================
--- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/LoginWorker.java (original)
+++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/LoginWorker.java Fri Apr 29 18:54:49 2016
@@ -29,6 +29,7 @@ import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import java.util.ServiceLoader;
+import java.util.UUID;
import java.util.concurrent.ConcurrentHashMap;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -157,7 +158,8 @@ public class LoginWorker {
//no key made yet for this request, create one
while (externalKey == null || externalLoginKeys.containsKey(externalKey)) {
- externalKey = "EL" + Long.toString(Math.round(Math.random() * 1000000)) + Long.toString(Math.round(Math.random() * 1000000));
+ UUID uuid = UUID.randomUUID();
+ externalKey = "EL" + uuid.toString();
}
request.setAttribute(EXTERNAL_LOGIN_KEY_ATTR, externalKey);
Modified: ofbiz/trunk/specialpurpose/ldap/src/org/ofbiz/ldap/cas/OFBizCasAuthenticationHandler.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/specialpurpose/ldap/src/org/ofbiz/ldap/cas/OFBizCasAuthenticationHandler.java?rev=1741684&r1=1741683&r2=1741684&view=diff
==============================================================================
--- ofbiz/trunk/specialpurpose/ldap/src/org/ofbiz/ldap/cas/OFBizCasAuthenticationHandler.java (original)
+++ ofbiz/trunk/specialpurpose/ldap/src/org/ofbiz/ldap/cas/OFBizCasAuthenticationHandler.java Fri Apr 29 18:54:49 2016
@@ -26,11 +26,14 @@ import java.io.UnsupportedEncodingExcept
import java.net.URL;
import java.net.URLConnection;
import java.net.URLEncoder;
+import java.security.SecureRandom;
+
import javax.naming.NamingException;
import javax.naming.directory.SearchResult;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+
import org.ofbiz.base.util.UtilXml;
import org.ofbiz.ldap.commons.AbstractOFBizAuthenticationHandler;
import org.ofbiz.ldap.commons.InterfaceOFBizAuthenticationHandler;
@@ -129,7 +132,7 @@ public final class OFBizCasAuthenticatio
}
private static int rand(int lo, int hi) {
- java.util.Random rn = new java.util.Random();
+ java.util.Random rn = new SecureRandom();
int n = hi - lo + 1;
int i = rn.nextInt() % n;
if (i < 0)