You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by de...@apache.org on 2007/03/18 23:26:28 UTC
svn commit: r519713 - in /myfaces:
core/branches/jsf12/impl/src/main/java/org/apache/myfaces/webapp/
shared/branches/3_0_0/core/src/main/java/org/apache/myfaces/shared/util/
shared/branches/3_0_0/core/src/test/java/org/apache/myfaces/shared/util/
Author: dennisbyrne
Date: Sun Mar 18 15:26:26 2007
New Revision: 519713
URL: http://svn.apache.org/viewvc?view=rev&rev=519713
Log:
JSF 1.2 requires encryption, encryption conf will be done in myfaces traditional upper case context params
Modified:
myfaces/core/branches/jsf12/impl/src/main/java/org/apache/myfaces/webapp/DefaultFacesInitializer.java
myfaces/shared/branches/3_0_0/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java
myfaces/shared/branches/3_0_0/core/src/test/java/org/apache/myfaces/shared/util/SecretKeyCacheTest.java
Modified: myfaces/core/branches/jsf12/impl/src/main/java/org/apache/myfaces/webapp/DefaultFacesInitializer.java
URL: http://svn.apache.org/viewvc/myfaces/core/branches/jsf12/impl/src/main/java/org/apache/myfaces/webapp/DefaultFacesInitializer.java?view=diff&rev=519713&r1=519712&r2=519713
==============================================================================
--- myfaces/core/branches/jsf12/impl/src/main/java/org/apache/myfaces/webapp/DefaultFacesInitializer.java (original)
+++ myfaces/core/branches/jsf12/impl/src/main/java/org/apache/myfaces/webapp/DefaultFacesInitializer.java Sun Mar 18 15:26:26 2007
@@ -106,8 +106,7 @@
// parse web.xml
WebXml.init(externalContext);
- if (servletContext.getInitParameter(StateUtils.INIT_SECRET) != null
- || servletContext.getInitParameter(StateUtils.INIT_SECRET.toLowerCase()) != null)
+ if (! "false".equals(servletContext.getInitParameter(StateUtils.USE_ENCRYPTION)))
StateUtils.initSecret(servletContext);
log.info("ServletContext '" + servletContext.getRealPath("/") + "' initialized.");
Modified: myfaces/shared/branches/3_0_0/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java
URL: http://svn.apache.org/viewvc/myfaces/shared/branches/3_0_0/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?view=diff&rev=519713&r1=519712&r2=519713
==============================================================================
--- myfaces/shared/branches/3_0_0/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java (original)
+++ myfaces/shared/branches/3_0_0/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java Sun Mar 18 15:26:26 2007
@@ -39,42 +39,31 @@
import java.util.zip.GZIPOutputStream;
/**
- * <p>This Class exposes a handful of methods related to encryption,
- * compression and serialization.</p>
+ * <p>Handles encryption, serialization, compression and encoding.
*
* <ul>
* <li>ISO-8859-1 is the character set used.</li>
* <li>GZIP is used for all compression/decompression.</li>
* <li>Base64 is used for all encoding and decoding.</li>
- * </ul>
- *
- * <p>To enable encryption, a secret must be provided. StateUtils looks first
- * for the <i>org.apache.myfaces.secret</i> init param.
- * If a secret cannot be located, encryption is not used.</p>
- *
- * <ul>
* <li>DES is the default encryption algorithm</li>
* <li>ECB is the default mode</li>
* <li>PKCS5Padding is the default padding</li>
* <li>The default algorithm can be overridden using the
- * <i>org.apache.myfaces.algorithm</i> parameter</li>
+ * <i>org.apache.myfaces.ALGORITHM</i> parameter</li>
* <li>The default mode and padding can be overridden using the
- * <i>org.apache.myfaces.algorithm.parameters</i> parameter</li>
- * <li>SecretKey cacheing can be disabled using the
- * <i>org.apache.myfaces.secret.cache</i> parameter</li>
- * <li>The defaults are not recommended</li>
- * <li>This utility has not been tested with modes other than ECB and CBC</li>
+ * <i>org.apache.myfaces.ALGORITHM.PARAMETERS</i> parameter</li>
+ * <li>This class has not been tested with modes other than ECB and CBC</li>
* <li>An initialization vector can be specified via the
- * <i>org.apache.myfaces.algorithm.parameters</i> parameter</li>
+ * <i>org.apache.myfaces.ALGORITHM.IV</i> parameter</li>
* </ul>
*
- * <p>All parameters are interpretted as base 64 encoded keys. In other
+ * <p>The secret is interpretted as base 64 encoded. In other
* words, if your secret is "76543210", you would put "NzY1NDMyMTA=" in
* the deployment descriptor. This is needed so that key values are not
* limited to just values composed of printable characters.</p>
*
* <p>If you are using CBC mode encryption, you <b>must</b> specify an
- * initialization vector. StateUtils will throw an exception otherwise.</p>
+ * initialization vector.</p>
*
* <p>If you are using the AES algorithm and getting a SecurityException
* complaining about keysize, you most likely need to get the unlimited
@@ -95,11 +84,12 @@
public static final String DEFAULT_ALGORITHM_PARAMS = "ECB/PKCS5Padding";
public static final String INIT_PREFIX = "org.apache.myfaces.";
- public static final String INIT_SECRET = INIT_PREFIX + "secret";
- public static final String INIT_ALGORITHM = INIT_PREFIX + "algorithm";
- public static final String INIT_SECRET_KEY_CACHE = INIT_PREFIX + "secret.cache";
- public static final String INIT_ALGORITHM_IV = INIT_PREFIX + "algorithm.iv";
- public static final String INIT_ALGORITHM_PARAM = INIT_PREFIX + "algorithm.parameters";
+ public static final String USE_ENCRYPTION = INIT_PREFIX + "USE_ENCRYPTION";
+ public static final String INIT_SECRET = INIT_PREFIX + "SECRET";
+ public static final String INIT_ALGORITHM = INIT_PREFIX + "ALGORITHM";
+ public static final String INIT_SECRET_KEY_CACHE = INIT_SECRET + ".CACHE";
+ public static final String INIT_ALGORITHM_IV = INIT_ALGORITHM + ".IV";
+ public static final String INIT_ALGORITHM_PARAM = INIT_ALGORITHM + ".PARAMETERS";
public static final String SERIAL_FACTORY = INIT_PREFIX + "SERIAL_FACTORY";
@@ -138,7 +128,7 @@
if(ctx == null)
throw new NullPointerException("ExternalContext ctx");
- return ctx.getInitParameter(INIT_SECRET) != null;
+ return ! "false".equals(ctx.getInitParameter(USE_ENCRYPTION));
}
/**
@@ -381,18 +371,6 @@
}
}
-
- private static byte[] symmetric(byte[] data, byte[] secret,
- String algorithm, String algorithmParams, byte[] iv, int mode)
- {
-
- if(log.isDebugEnabled())
- log.debug("creating new SecretKey");
-
- SecretKey secretKey = new SecretKeySpec(secret, algorithm);
- return symmetric(data, secretKey, algorithm, algorithmParams, iv, mode);
-
- }
/**
* Pulls configuration data from the context and performs symmetric encryption
@@ -415,7 +393,6 @@
String _algorithm = ctx.getInitParameter(INIT_ALGORITHM);
String _algorithmParams = ctx.getInitParameter(INIT_ALGORITHM_PARAM);
String _iv = ctx.getInitParameter(INIT_ALGORITHM_IV);
- String _cache = ctx.getInitParameter(INIT_SECRET_KEY_CACHE);
// use isSecure() before calling this method
if (_secret == null)
@@ -450,27 +427,12 @@
if (_iv != null)
iv = base64.decode(_iv.getBytes());
-
- if(_cache != null && "false".equals(_cache)){
-
- // secret will have to be decoded and SecretKey will have to
- // be generated
-
- byte[] secret = base64.decode(_secret.getBytes());
-
- return symmetric(data, secret, _algorithm, _algorithmParams, iv, mode);
-
- }
Object object = ctx.getApplicationMap().get(INIT_SECRET_KEY_CACHE);
if( object == null )
- throw new NullPointerException("The context parameter '"
- + INIT_SECRET_KEY_CACHE + "' is not set to false, "
- + "yet there is nothing stored in the application map "
- + "w/ the following key '" + INIT_SECRET_KEY_CACHE + "'. "
- + "It was either not placed there by StartupServletContextListener "
- + "or something has removed it.");
+ throw new NullPointerException("Could not find SecretKey in application scope using key '"
+ + INIT_SECRET_KEY_CACHE + "'");
if( ! ( object instanceof SecretKey ) )
throw new ClassCastException("Did not find an instance of SecretKey "
@@ -498,13 +460,27 @@
if(ctx == null)
throw new NullPointerException("ServletContext ctx");
- String cache = ctx.getInitParameter(INIT_SECRET_KEY_CACHE);
+ if (log.isDebugEnabled())
+ log.debug("Storing SecretKey @ " + INIT_SECRET_KEY_CACHE);
- if("false".equals(cache))
- return;
+ // you want to create this as few times as possible
+ ctx.setAttribute(INIT_SECRET_KEY_CACHE, new SecretKeySpec(findSecret(ctx), findAlgorithm(ctx)));
- String _secret = ctx.getInitParameter(INIT_SECRET);
- String _algorithm = ctx.getInitParameter(INIT_ALGORITHM);
+ }
+
+ private static byte[] findSecret(ServletContext ctx) {
+ String _secret = ctx.getInitParameter(INIT_SECRET);
+
+ if(_secret == null)
+ {
+ _secret = "00000000";// TODO generate random secret
+ }
+
+ return new Base64().decode(_secret.getBytes());
+ }
+
+ private static String findAlgorithm(ServletContext ctx) {
+ String _algorithm = ctx.getInitParameter(INIT_ALGORITHM);
if (_algorithm == null)
{
@@ -514,21 +490,6 @@
}
_algorithm = DEFAULT_ALGORITHM;
}
-
- if(_secret == null)
- throw new NullPointerException("_secret String - '"
- + INIT_SECRET_KEY_CACHE + "' has been enabled, "
- + "but there is no '" + INIT_SECRET + "'");
-
- byte[] secret = new Base64().decode(_secret.getBytes());
-
- // you want to do this as few times as possible
- SecretKey secretKey = new SecretKeySpec(secret, _algorithm);
-
- if (log.isDebugEnabled())
- log.debug("Storing SecretKey @ " + INIT_SECRET_KEY_CACHE);
-
- ctx.setAttribute(INIT_SECRET_KEY_CACHE, secretKey);
-
- }
+ return _algorithm;
+ }
}
Modified: myfaces/shared/branches/3_0_0/core/src/test/java/org/apache/myfaces/shared/util/SecretKeyCacheTest.java
URL: http://svn.apache.org/viewvc/myfaces/shared/branches/3_0_0/core/src/test/java/org/apache/myfaces/shared/util/SecretKeyCacheTest.java?view=diff&rev=519713&r1=519712&r2=519713
==============================================================================
--- myfaces/shared/branches/3_0_0/core/src/test/java/org/apache/myfaces/shared/util/SecretKeyCacheTest.java (original)
+++ myfaces/shared/branches/3_0_0/core/src/test/java/org/apache/myfaces/shared/util/SecretKeyCacheTest.java Sun Mar 18 15:26:26 2007
@@ -60,18 +60,6 @@
}
- public void testInitFacesWithoutCache(){
-
- servletContext.addInitParameter(StateUtils.INIT_SECRET_KEY_CACHE, "false");
-
- StateUtils.initSecret(servletContext);
-
- Object object = servletContext.getAttribute(StateUtils.INIT_SECRET_KEY_CACHE);
-
- assertNull("Making sure StateUtils.initSecret does not create a SecretKey", object);
-
- }
-
public void testInitFacesWithCache(){
StateUtils.initSecret(servletContext);