[isis] branch master updated: ISIS-2297: use SecureRandom over Random in _CryptFactory

[ahuber]

This is an automated email from the ASF dual-hosted git repository.

ahuber pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/isis.git


The following commit(s) were added to refs/heads/master by this push:
     new b44945cd7f ISIS-2297: use SecureRandom over Random in _CryptFactory
b44945cd7f is described below

commit b44945cd7f8b10a2764e45112d44d6c1af8cbcca
Author: Andi Huber <ahu...@apache.org>
AuthorDate: Mon Apr 11 13:09:48 2022 +0200

    ISIS-2297: use SecureRandom over Random in _CryptFactory
---
 .../isis/viewer/wicket/viewer/wicketapp/_CryptFactory.java   | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git 
a/viewers/wicket/viewer/src/main/java/org/apache/isis/viewer/wicket/viewer/wicketapp/_CryptFactory.java
 
b/viewers/wicket/viewer/src/main/java/org/apache/isis/viewer/wicket/viewer/wicketapp/_CryptFactory.java
index 2694371228..50a71a2404 100644
--- 
a/viewers/wicket/viewer/src/main/java/org/apache/isis/viewer/wicket/viewer/wicketapp/_CryptFactory.java
+++ 
b/viewers/wicket/viewer/src/main/java/org/apache/isis/viewer/wicket/viewer/wicketapp/_CryptFactory.java
@@ -18,6 +18,7 @@
  */
 package org.apache.isis.viewer.wicket.viewer.wicketapp;
 
+import java.security.SecureRandom;
 import java.security.spec.KeySpec;
 import java.util.Random;
 
@@ -82,23 +83,24 @@ class _CryptFactory {
     private byte[] getSalt(final int size, final String encryptionKey) {
         final byte[] salt = FIXED_SALT_FOR_PROTOTYPING.equals(encryptionKey)
                 ? machineFixedSalt(size)
-                : randomSalt(size);
+                : secureSalt(size);
         return salt;
     }
 
     /**
-     * cloned from {@link SunJceCrypt#randomSalt()}
+     * Cloned from {@link SunJceCrypt#randomSalt()},
+     * but using {@link SecureRandom} instead of {@link Random}.
      */
-    private byte[] randomSalt(final int size) {
+    private byte[] secureSalt(final int size) {
         val salt = new byte[size];
-        new Random().nextBytes(salt);
+        new SecureRandom().nextBytes(salt);
         return salt;
     }
 
     private byte[] machineFixedSalt(final int size) {
         val machineFixedSeed = _OsUtil.machineId();
         if(machineFixedSeed.isEmpty()){
-            return randomSalt(size);
+            return secureSalt(size);
         }
         val salt = new byte[size];
         new Random(machineFixedSeed.getAsLong()).nextBytes(salt);