You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by ta...@apache.org on 2021/01/18 14:08:23 UTC
[myfaces] branch master updated: prefer secureRandom over random
This is an automated email from the ASF dual-hosted git repository.
tandraschko pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/myfaces.git
The following commit(s) were added to refs/heads/master by this push:
new b806cec prefer secureRandom over random
new 95cbf6c Merge pull request #149 from bohmber/MYFACES-4373-master
b806cec is described below
commit b806ceca50c669b7be507887b5933af08c09a142
Author: Bernd Bohmann <bo...@apache.org>
AuthorDate: Sat Jan 16 17:57:14 2021 +0100
prefer secureRandom over random
---
.../org/apache/myfaces/config/MyfacesConfig.java | 8 +-
.../push/cdi/WebsocketChannelTokenBuilderBean.java | 144 ++++++++++-----------
2 files changed, 76 insertions(+), 76 deletions(-)
diff --git a/impl/src/main/java/org/apache/myfaces/config/MyfacesConfig.java b/impl/src/main/java/org/apache/myfaces/config/MyfacesConfig.java
index 2257810..eb51686 100755
--- a/impl/src/main/java/org/apache/myfaces/config/MyfacesConfig.java
+++ b/impl/src/main/java/org/apache/myfaces/config/MyfacesConfig.java
@@ -436,14 +436,14 @@ public class MyfacesConfig
* Defines how to generate the csrf session token.
*/
@JSFWebConfigParam(since="2.2.0", expectedValues="secureRandom, random",
- defaultValue="none", group="state")
+ defaultValue="secureRandom", group="state")
public static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN
= "org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN";
- private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_DEFAULT = "random";
-
+
public static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_SECURE_RANDOM = "secureRandom";
public static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_RANDOM = "random";
-
+ private static final String RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_DEFAULT = RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_SECURE_RANDOM;
+
/**
* Define the time in minutes where the view state is valid when
* client side state saving is used. By default it is set to 0
diff --git a/impl/src/main/java/org/apache/myfaces/push/cdi/WebsocketChannelTokenBuilderBean.java b/impl/src/main/java/org/apache/myfaces/push/cdi/WebsocketChannelTokenBuilderBean.java
index ce0f884..a93db4e 100644
--- a/impl/src/main/java/org/apache/myfaces/push/cdi/WebsocketChannelTokenBuilderBean.java
+++ b/impl/src/main/java/org/apache/myfaces/push/cdi/WebsocketChannelTokenBuilderBean.java
@@ -1,72 +1,72 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.myfaces.push.cdi;
-
-import jakarta.annotation.PostConstruct;
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.faces.context.FacesContext;
-import org.apache.myfaces.util.token.CsrfSessionTokenFactory;
-import org.apache.myfaces.util.token.CsrfSessionTokenFactoryRandom;
-import org.apache.myfaces.util.token.CsrfSessionTokenFactorySecureRandom;
-import org.apache.myfaces.config.MyfacesConfig;
-
-@ApplicationScoped
-public class WebsocketChannelTokenBuilderBean
-{
- private CsrfSessionTokenFactory csrfSessionTokenFactory;
-
- private boolean initialized;
-
- public WebsocketChannelTokenBuilderBean()
- {
- }
-
- @PostConstruct
- public void init()
- {
- FacesContext facesContext = FacesContext.getCurrentInstance();
- if (facesContext != null)
- {
- internalInit(facesContext);
- }
- }
-
- private synchronized void internalInit(FacesContext facesContext)
- {
- String csrfRandomMode = MyfacesConfig.getCurrentInstance(facesContext).getRandomKeyInViewStateSessionToken();
- if (MyfacesConfig.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_SECURE_RANDOM.equals(csrfRandomMode))
- {
- csrfSessionTokenFactory = new CsrfSessionTokenFactorySecureRandom(facesContext);
- }
- else
- {
- csrfSessionTokenFactory = new CsrfSessionTokenFactoryRandom(facesContext);
- }
- initialized = true;
- }
-
- public String createChannelToken(FacesContext facesContext, String channel)
- {
- if (!initialized)
- {
- internalInit(facesContext);
- }
- return csrfSessionTokenFactory.createToken(facesContext);
- }
-}
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.push.cdi;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.faces.context.FacesContext;
+import org.apache.myfaces.util.token.CsrfSessionTokenFactory;
+import org.apache.myfaces.util.token.CsrfSessionTokenFactoryRandom;
+import org.apache.myfaces.util.token.CsrfSessionTokenFactorySecureRandom;
+import org.apache.myfaces.config.MyfacesConfig;
+
+@ApplicationScoped
+public class WebsocketChannelTokenBuilderBean
+{
+ private CsrfSessionTokenFactory csrfSessionTokenFactory;
+
+ private boolean initialized;
+
+ public WebsocketChannelTokenBuilderBean()
+ {
+ }
+
+ @PostConstruct
+ public void init()
+ {
+ FacesContext facesContext = FacesContext.getCurrentInstance();
+ if (facesContext != null)
+ {
+ internalInit(facesContext);
+ }
+ }
+
+ private synchronized void internalInit(FacesContext facesContext)
+ {
+ String csrfRandomMode = MyfacesConfig.getCurrentInstance(facesContext).getRandomKeyInViewStateSessionToken();
+ if (MyfacesConfig.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN_RANDOM.equals(csrfRandomMode))
+ {
+ csrfSessionTokenFactory = new CsrfSessionTokenFactoryRandom(facesContext);
+ }
+ else
+ {
+ csrfSessionTokenFactory = new CsrfSessionTokenFactorySecureRandom(facesContext);
+ }
+ initialized = true;
+ }
+
+ public String createChannelToken(FacesContext facesContext, String channel)
+ {
+ if (!initialized)
+ {
+ internalInit(facesContext);
+ }
+ return csrfSessionTokenFactory.createToken(facesContext);
+ }
+}