(cxf) branch 4.1.x-fixes updated: Fixup #3423 Use a properly random source to generate digest client (#3452)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/4.1.x-fixes by this push:
     new 391f3c782f7 Fixup #3423 Use a properly random source to generate 
digest client (#3452)
391f3c782f7 is described below

commit 391f3c782f7b5c531c1f1f2047a500d4aa0bf20a
Author: Peter Palaga <ppal...@redhat.com>
AuthorDate: Tue Sep 8 10:57:03 2026 +0200

    Fixup #3423 Use a properly random source to generate digest client (#3452)
    
    nonces
    
    Avoid static initialization of Random/SecureRandom to allow build time
    class initialization with GraalVM native image
---
 .../cxf/transport/http/auth/DigestAuthSupplier.java    | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git 
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/DigestAuthSupplier.java
 
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/DigestAuthSupplier.java
index 6ab3931f90d..c7fd15c45fe 100644
--- 
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/DigestAuthSupplier.java
+++ 
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/DigestAuthSupplier.java
@@ -37,7 +37,8 @@ import static java.nio.charset.StandardCharsets.US_ASCII;
  *
  */
 public class DigestAuthSupplier implements HttpAuthSupplier {
-    private static final SecureRandom CNONCE_GENERATOR = new SecureRandom();
+    private static volatile SecureRandom cnonceGenerator;
+    private static final Object CNONCE_GENERATOR_LOCK = new Object();
 
     Map<URI, DigestInfo> authInfo = new ConcurrentHashMap<>();
 
@@ -117,7 +118,20 @@ public class DigestAuthSupplier implements 
HttpAuthSupplier {
      */
     public String createCnonce() {
         byte[] bytes = new byte[16];
-        CNONCE_GENERATOR.nextBytes(bytes);
+
+        SecureRandom cg;
+        // CHECKSTYLE:OFF
+        // May the Gods of Code Style forgive us these three inner assignments
+        if ((cg = cnonceGenerator) == null) {
+            synchronized (CNONCE_GENERATOR_LOCK) {
+                if ((cg = cnonceGenerator) == null) {
+                    cg = cnonceGenerator = new SecureRandom();
+                }
+            }
+        }
+        // CHECKSTYLE:ON
+
+        cg.nextBytes(bytes);
         return StringUtils.toHexString(bytes);
     }