github-advanced-security[bot] commented on code in PR #3408:
URL: https://github.com/apache/cxf/pull/3408#discussion_r3879930916
##########
rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/crypto/ModelEncryptionSupport.java:
##########
@@ -229,10 +242,55 @@
String encodedData,
Key key,
KeyProperties props) throws
SecurityException {
- String decryptedSequence = CryptoUtils.decryptSequence(encodedData,
key, props);
+ String decryptedSequence = decryptSequence(encodedData, key, props);
return recreateCodeGrant(provider, decryptedSequence);
}
+ /**
+ * Encrypts the sequence. When no explicit KeyProperties are supplied the
+ * authenticated AES/GCM transformation is used, with a random IV prepended
+ * to the ciphertext. The previous default (the JCE "AES" shorthand, i.e.
+ * AES/ECB/PKCS5Padding) produced deterministic, malleable ciphertexts
which
+ * a client holding several tokens could cut and splice block-by-block to
+ * forge token state; pass explicit KeyProperties only if a legacy
+ * transformation must be retained.
+ */
+ private static String encryptSequence(String sequence, Key secretKey,
+ KeyProperties props) throws
SecurityException {
+ if (props != null) {
+ return CryptoUtils.encryptSequence(sequence, secretKey, props);
+ }
+ byte[] iv = new byte[DEFAULT_IV_SIZE];
+ RANDOM.nextBytes(iv);
+ byte[] cipherText =
CryptoUtils.encryptBytes(sequence.getBytes(StandardCharsets.UTF_8),
+ secretKey,
gcmProperties(iv));
+ byte[] out = new byte[iv.length + cipherText.length];
Review Comment:
## CodeQL / Uncontrolled data in arithmetic expression
This arithmetic expression depends on an [uncontrolled value](1),
potentially causing an overflow.
[Show more
details](https://github.com/apache/cxf/security/code-scanning/2252)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
