This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 5b1856083d Improved: Use a single Apache Shiro version and drop
shiro-core (OFBIZ-13685)
5b1856083d is described below
commit 5b1856083d2f61ede3d7fd2cf14ca5d4cbf8d3eb
Author: Mridul Pathak <[email protected]>
AuthorDate: Thu Oct 15 14:52:58 2026 +0530
Improved: Use a single Apache Shiro version and drop shiro-core
(OFBIZ-13685)
The build declared shiro-core 1.13.0 next to shiro-crypto-cipher 2.2.1 with
separate version refs, so Dependabot bumped them independently and the runtime
mixed 1.x and 2.x Shiro modules. shiro-core 1.13.0 is a fat jar that duplicated
some 2.x classes, so which copy loaded depended on classpath order.
- Replace shiro-core and shiro-crypto-cipher with shiro-crypto-cipher,
shiro-crypto-core and shiro-lang on one shared version ref (3.0.1), the only
Shiro modules OFBiz uses.
- Compute the EntityCrypto key-name hash explicitly as Base64(SHA-512(key
name)). This is what Shiro 1.x's DefaultHashService produced by default; Shiro
2.x and later default to a salted argon2 hash, which would no longer match the
stored EntityKeyStore key names.
---
dependencies.gradle | 3 +--
.../main/java/org/apache/ofbiz/entity/util/EntityCrypto.java | 12 +++++-------
gradle/libs.versions.toml | 12 ++++++------
3 files changed, 12 insertions(+), 15 deletions(-)
diff --git a/dependencies.gradle b/dependencies.gradle
index 8ae7ab70b0..af5635ce92 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -55,8 +55,7 @@ dependencies {
implementation libs.poi
implementation libs.poi.ooxml
implementation libs.bundles.pdfbox
- implementation libs.shiro.core
- implementation libs.shiro.crypto.cipher
+ implementation libs.bundles.shiro
implementation libs.sshd.core
implementation libs.sshd.sftp
implementation libs.bundles.tika
diff --git
a/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntityCrypto.java
b/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntityCrypto.java
index ecedf691f4..f50387d3c5 100644
---
a/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntityCrypto.java
+++
b/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntityCrypto.java
@@ -24,6 +24,7 @@ import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;
import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.codec.digest.DigestUtils;
import org.apache.ofbiz.base.util.Debug;
import org.apache.ofbiz.base.util.GeneralException;
import org.apache.ofbiz.base.util.UtilObject;
@@ -37,9 +38,6 @@ import org.apache.ofbiz.entity.transaction.TransactionUtil;
import org.apache.shiro.crypto.cipher.AesCipherService;
import org.apache.shiro.crypto.cipher.OperationMode;
import org.apache.shiro.crypto.cipher.PaddingScheme;
-import org.apache.shiro.crypto.hash.DefaultHashService;
-import org.apache.shiro.crypto.hash.HashRequest;
-import org.apache.shiro.crypto.hash.HashService;
public final class EntityCrypto {
@@ -203,13 +201,11 @@ public final class EntityCrypto {
}
protected static final class ShiroStorageHandler extends StorageHandler {
- private final HashService hashService;
private final AesCipherService cipherService;
private final AesCipherService legacyCipherService;
private final byte[] kek;
protected ShiroStorageHandler(byte[] kek) {
- hashService = new DefaultHashService();
cipherService = new AesCipherService();
// Kept only to decrypt values written before the fix for
OFBIZ-13599, which forced AES into ECB
// mode (no IV, deterministic ciphertext) instead of using
AesCipherService's safer default.
@@ -227,8 +223,10 @@ public final class EntityCrypto {
@Override
protected String getHashedKeyName(String originalKeyName) {
- HashRequest hashRequest = new
HashRequest.Builder().setSource(originalKeyName).build();
- return hashService.computeHash(hashRequest).toBase64();
+ // Base64(SHA-512(UTF-8 key name)), unsalted and single-pass: the
EntityKeyStore lookup key, so it must
+ // never change. This is what Shiro 1.x's DefaultHashService
computed by default; Shiro 2.x+ defaults
+ // to a salted argon2 hash instead, which would orphan every
stored key.
+ return
Base64.encodeBase64String(DigestUtils.sha512(originalKeyName));
}
@Override
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 536e960851..6a06c318e5 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -55,10 +55,8 @@ httpclient-cache = "4.5.14"
log4j = "2.26.1"
poi = "5.5.1"
pdfbox = "3.0.8"
-# Got "Exception in thread "main" java.lang.UnsupportedOperationException:
Cannot create a hash with
-# the given algorithm: argon2" with 2.0.2 in integration tests
-shiro-core = "1.13.0"
-shiro-crypto-cipher = "2.2.1"
+# Shared by shiro-crypto-cipher, shiro-crypto-core, shiro-lang.
+shiro = "3.0.1"
# Shared by sshd-core, sshd-sftp.
sshd = "2.20.0"
# Shared by tika-core, tika-parsers, tika-parser-pdf-module.
@@ -151,8 +149,9 @@ poi = { module = "org.apache.poi:poi", version.ref = "poi" }
poi-ooxml = { module = "org.apache.poi:poi-ooxml", version.ref = "poi" }
pdfbox-core = { module = "org.apache.pdfbox:pdfbox", version.ref = "pdfbox" }
pdfbox-io = { module = "org.apache.pdfbox:pdfbox-io", version.ref = "pdfbox" }
-shiro-core = { module = "org.apache.shiro:shiro-core", version.ref =
"shiro-core" }
-shiro-crypto-cipher = { module = "org.apache.shiro:shiro-crypto-cipher",
version.ref = "shiro-crypto-cipher" }
+shiro-crypto-cipher = { module = "org.apache.shiro:shiro-crypto-cipher",
version.ref = "shiro" }
+shiro-crypto-core = { module = "org.apache.shiro:shiro-crypto-core",
version.ref = "shiro" }
+shiro-lang = { module = "org.apache.shiro:shiro-lang", version.ref = "shiro" }
sshd-core = { module = "org.apache.sshd:sshd-core", version.ref = "sshd" }
sshd-sftp = { module = "org.apache.sshd:sshd-sftp", version.ref = "sshd" }
tika-core = { module = "org.apache.tika:tika-core", version.ref = "tika" }
@@ -218,3 +217,4 @@ swagger = ["swagger-jaxrs2-core",
"swagger-jaxrs2-servlet-initializer", "swagger
batik = ["batik-anim", "batik-util", "batik-bridge"]
tika = ["tika-core", "tika-parsers", "tika-parser-pdf-module"]
pdfbox = ["pdfbox-core", "pdfbox-io"]
+shiro = ["shiro-crypto-cipher", "shiro-crypto-core", "shiro-lang"]
