(ofbiz-framework) branch trunk updated: Fixed: PBKDF2 password verification always fails in HashCrypt.doComparePbkdf2 (OFBIZ-13609)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 326481a0ee Fixed: PBKDF2 password verification always fails in 
HashCrypt.doComparePbkdf2 (OFBIZ-13609)
326481a0ee is described below

commit 326481a0ee1527d1d7dd70592d5835671abd7be3
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sat Sep 26 16:08:24 2026 +0530

    Fixed: PBKDF2 password verification always fails in 
HashCrypt.doComparePbkdf2 (OFBIZ-13609)
    
    doComparePbkdf2 wrapped the decoded salt in Arrays.toString(...), so the 
salt used for verification never matched the one used to create the hash, and 
every PBKDF2 login failed even with the correct password. Use the decoded salt 
bytes directly. Hash creation is unchanged, so existing PBKDF2 hashes, 
including pre-2019 ones, verify again.
---
 .../base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java 
b/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java
index daac19b96f..4be9e7d564 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java
@@ -217,8 +217,7 @@ public class HashCrypt {
             String hashType = crypted.substring(1, typeEnd);
             String[] parts = crypted.split("\\$");
             int iterations = Integer.parseInt(parts[0].substring(typeEnd + 1));
-            byte[] salt = 
Arrays.toString(java.util.Base64.getMimeDecoder().decode(parts[1].getBytes(StandardCharsets.UTF_8)))
-                    .getBytes(StandardCharsets.UTF_8);
+            byte[] salt = 
java.util.Base64.getMimeDecoder().decode(parts[1].getBytes(StandardCharsets.UTF_8));
             byte[] hash = 
Base64.decodeBase64(parts[2].getBytes(StandardCharsets.UTF_8));
 
             PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 
iterations, hash.length * 8);