Author: stillalex
Date: Tue May 7 09:53:00 2019
New Revision: 1858836
URL: http://svn.apache.org/viewvc?rev=1858836&view=rev
Log:
OAK-7778 PasswordUtil#isPlainTextPassword doesn't validate PBKDF2 scheme
Modified:
jackrabbit/oak/branches/1.8/ (props changed)
jackrabbit/oak/branches/1.8/oak-jcr/ (props changed)
jackrabbit/oak/branches/1.8/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/user/UserImportTest.java
jackrabbit/oak/branches/1.8/oak-security-spi/src/main/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtil.java
jackrabbit/oak/branches/1.8/oak-security-spi/src/test/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtilTest.java
Propchange: jackrabbit/oak/branches/1.8/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue May 7 09:53:00 2019
@@ -1,3 +1,3 @@
/jackrabbit/oak/branches/1.0:1665962
-/jackrabbit/oak/trunk:1820660-1820661,1820729,1820734,1820859,1820861,1820878,1820888,1820947,1821027,1821130,1821140-1821141,1821178,1821237,1821240,1821249,1821258,1821325,1821358,1821361-1821362,1821370,1821375,1821393,1821477,1821487,1821516,1821617,1821663,1821665,1821668,1821681,1821847,1821975-1821983,1822121,1822182,1822201,1822207,1822527,1822642,1822723,1822808,1822850,1822934,1823135,1823163,1823169,1823172,1823655,1823669,1824196,1824198,1824253,1824255,1824896,1824962,1825065,1825362,1825381,1825442,1825448,1825466,1825470-1825471,1825475,1825523,1825525,1825561,1825619-1825621,1825651,1825654,1825992,1826079,1826090,1826096,1826216,1826237,1826338,1826516,1826532,1826551,1826560,1826638,1826640,1826730,1826833,1826932,1826957,1827423,1827472,1827486,1827816,1827977,1828349,1828439,1828502,1828529,1828827,1828868,1828948,1829527,1829534,1829546,1829569,1829587,1829665,1829854,1829864,1829978,1829985,1829987,1829998,1830019,1830048,1830160,1830171,1830197,1830209,1830239
,1830347,1830748,1830911,1830923,1831157-1831158,1831163,1831190,1831374,1831560,1831689,1832258,1832376,1832379,1832535,1833308,1833347,1833702,1833833,1834109,1834112,1834117,1834287,1834291,1834302,1834312,1834326,1834328,1834336,1834428,1834468,1834483,1834610,1834648-1834649,1834681,1834823,1834857-1834858,1835060,1835518,1835521,1835635,1835642,1835780,1835819,1836082,1836121,1836167-1836168,1836170-1836187,1836189-1836196,1836206,1836487,1836493,1836548,1837057,1837274,1837296,1837326,1837475,1837503,1837547,1837569,1837596,1837600,1837657,1837718,1837998,1838076,1838637,1839549,1839570,1839637,1839746,1840019,1840024,1840031,1840226,1840455,1840462,1840574,1840769,1841314,1841352,1842089,1842677,1843175,1843222,1843231,1843398,1843618,1843621,1843637,1843652,1843669,1843905,1843911,1844070,1844110,1844325,1844549,1844625,1844627,1844642,1844728,1844775,1844932,1845135,1845336,1845405,1845415,1845730-1845731,1845863,1845865,1846057,1846396,1846429,1846581,1846617,1847088,1847
096,1848073,1848181-1848182,1848191,1848217,1848822-1848823,1850221,1850837,1850874,1851533-1851535,1851619,1852120,1852451,1852492-1852493,1852528,1852582,1852584,1852601,1853141,1853229,1853393,1853429,1853433,1853866,1853868,1853870,1853893,1853969,1853997,1854034,1854044,1854055,1854455,1854461-1854462,1854466,1854515,1854539,1854701,1854773,1854827,1854848,1854859,1854930,1855032,1855776,1856818,1857010,1857247,1857253,1857294,1857314,1857638,1857936,1858032,1858571,1858578,1858810
+/jackrabbit/oak/trunk:1820660-1820661,1820729,1820734,1820859,1820861,1820878,1820888,1820947,1821027,1821130,1821140-1821141,1821178,1821237,1821240,1821249,1821258,1821325,1821358,1821361-1821362,1821370,1821375,1821393,1821477,1821487,1821516,1821617,1821663,1821665,1821668,1821681,1821847,1821975-1821983,1822121,1822182,1822201,1822207,1822527,1822642,1822723,1822808,1822850,1822934,1823135,1823163,1823169,1823172,1823655,1823669,1824196,1824198,1824253,1824255,1824896,1824962,1825065,1825362,1825381,1825442,1825448,1825466,1825470-1825471,1825475,1825523,1825525,1825561,1825619-1825621,1825651,1825654,1825992,1826079,1826090,1826096,1826216,1826237,1826338,1826516,1826532,1826551,1826560,1826638,1826640,1826730,1826833,1826932,1826957,1827423,1827472,1827486,1827816,1827977,1828349,1828439,1828502,1828529,1828827,1828868,1828948,1829527,1829534,1829546,1829569,1829587,1829665,1829854,1829864,1829978,1829985,1829987,1829998,1830019,1830048,1830160,1830171,1830197,1830209,1830239
,1830347,1830748,1830911,1830923,1831157-1831158,1831163,1831190,1831374,1831560,1831689,1832258,1832376,1832379,1832535,1833308,1833347,1833702,1833833,1834109,1834112,1834117,1834287,1834291,1834302,1834312,1834326,1834328,1834336,1834428,1834468,1834483,1834610,1834648-1834649,1834681,1834823,1834857-1834858,1835060,1835518,1835521,1835635,1835642,1835780,1835819,1836082,1836121,1836167-1836168,1836170-1836187,1836189-1836196,1836206,1836487,1836493,1836548,1837057,1837274,1837296,1837326,1837475,1837503,1837547,1837569,1837596,1837600,1837657,1837718,1837998,1838076,1838637,1839549,1839570,1839637,1839746,1840019,1840024,1840031,1840226,1840455,1840462,1840574,1840769,1841314,1841352,1841909,1842089,1842677,1843175,1843222,1843231,1843398,1843618,1843621,1843637,1843652,1843669,1843905,1843911,1844070,1844110,1844325,1844549,1844625,1844627,1844642,1844728,1844775,1844932,1845135,1845336,1845405,1845415,1845730-1845731,1845863,1845865,1846057,1846396,1846429,1846581,1846617,1847
088,1847096,1848073,1848181-1848182,1848191,1848217,1848822-1848823,1850221,1850837,1850874,1851533-1851535,1851619,1852120,1852451,1852492-1852493,1852528,1852582,1852584,1852601,1853141,1853229,1853393,1853429,1853433,1853866,1853868,1853870,1853893,1853969,1853997,1854034,1854044,1854055,1854455,1854461-1854462,1854466,1854515,1854539,1854701,1854773,1854827,1854848,1854859,1854930,1855032,1855776,1856818,1857010,1857247,1857253,1857294,1857314,1857638,1857936,1858032,1858571,1858578,1858810
/jackrabbit/trunk:1345480
Propchange: jackrabbit/oak/branches/1.8/oak-jcr/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue May 7 09:53:00 2019
@@ -1,3 +1,3 @@
/jackrabbit/oak/branches/1.0/oak-jcr:1665962
-/jackrabbit/oak/trunk/oak-jcr:1820660-1820661,1820729,1820734,1820859,1820861,1820878,1820888,1820947,1821130,1821140-1821141,1821240,1821249,1821258,1821325,1821358,1821361-1821362,1821370,1821375,1821393,1821477,1821487,1821516,1821665,1821668,1821681,1821979,1822121,1822201,1822207,1822723,1822808,1822850,1822934,1823135,1823163,1823169,1824196,1824198,1824962,1825362,1825381,1825442,1825448,1825466,1825470,1825475,1825523,1825525,1825619-1825621,1825651,1825654,1825992,1826079,1826090,1826096,1826237,1826338,1826516,1826532,1826640,1826932,1826957,1827472,1827486,1827977,1829987,1830019,1830160,1830170,1830911,1830923,1831689,1833347,1836182,1847088,1853141,1853229
+/jackrabbit/oak/trunk/oak-jcr:1820660-1820661,1820729,1820734,1820859,1820861,1820878,1820888,1820947,1821130,1821140-1821141,1821240,1821249,1821258,1821325,1821358,1821361-1821362,1821370,1821375,1821393,1821477,1821487,1821516,1821665,1821668,1821681,1821979,1822121,1822201,1822207,1822723,1822808,1822850,1822934,1823135,1823163,1823169,1824196,1824198,1824962,1825362,1825381,1825442,1825448,1825466,1825470,1825475,1825523,1825525,1825619-1825621,1825651,1825654,1825992,1826079,1826090,1826096,1826237,1826338,1826516,1826532,1826640,1826932,1826957,1827472,1827486,1827977,1829987,1830019,1830160,1830170,1830911,1830923,1831689,1833347,1836182,1841909,1847088,1853141,1853229
/jackrabbit/trunk/oak-jcr:1345480
Modified:
jackrabbit/oak/branches/1.8/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/user/UserImportTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.8/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/user/UserImportTest.java?rev=1858836&r1=1858835&r2=1858836&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.8/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/user/UserImportTest.java
(original)
+++
jackrabbit/oak/branches/1.8/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/user/UserImportTest.java
Tue May 7 09:53:00 2019
@@ -35,6 +35,7 @@ import org.apache.jackrabbit.api.securit
import org.apache.jackrabbit.api.security.user.Impersonation;
import org.apache.jackrabbit.api.security.user.User;
import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
+import org.apache.jackrabbit.oak.spi.security.user.util.PasswordUtil;
import org.apache.jackrabbit.test.NotExecutableException;
import org.junit.Test;
@@ -226,7 +227,7 @@ public class UserImportTest extends Abst
String pwValue = n.getProperty(UserConstants.REP_PASSWORD).getString();
assertFalse(plainPw.equals(pwValue));
- assertTrue(pwValue.toLowerCase().startsWith("{sha"));
+ assertTrue(pwValue.toLowerCase().startsWith("{" +
PasswordUtil.DEFAULT_ALGORITHM.toLowerCase()));
}
/**
Modified:
jackrabbit/oak/branches/1.8/oak-security-spi/src/main/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtil.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.8/oak-security-spi/src/main/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtil.java?rev=1858836&r1=1858835&r2=1858836&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.8/oak-security-spi/src/main/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtil.java
(original)
+++
jackrabbit/oak/branches/1.8/oak-security-spi/src/main/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtil.java
Tue May 7 09:53:00 2019
@@ -50,7 +50,7 @@ public final class PasswordUtil {
/**
* @since OAK 1.0
*/
- private static final String PBKDF2_PREFIX = "PBKDF2";
+ static final String PBKDF2_PREFIX = "PBKDF2";
public static final String DEFAULT_ALGORITHM = "SHA-256";
public static final int DEFAULT_SALT_SIZE = 8;
@@ -159,7 +159,7 @@ public final class PasswordUtil {
* the given {@code hashedPassword} string.
*/
public static boolean isSame(@Nullable String hashedPassword, @NotNull
String password) {
- if (hashedPassword == null) {
+ if (hashedPassword == null || password == null) {
return false;
}
try {
@@ -329,7 +329,11 @@ public final class PasswordUtil {
if (hashedPwd.charAt(0) == '{' && end > 0 && end <
hashedPwd.length()-1) {
String algorithm = hashedPwd.substring(1, end);
try {
- MessageDigest.getInstance(algorithm);
+ if (algorithm.startsWith(PBKDF2_PREFIX)) {
+ SecretKeyFactory.getInstance(algorithm);
+ } else {
+ MessageDigest.getInstance(algorithm);
+ }
return algorithm;
} catch (NoSuchAlgorithmException e) {
log.debug("Invalid algorithm detected " + algorithm, e);
Modified:
jackrabbit/oak/branches/1.8/oak-security-spi/src/test/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtilTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.8/oak-security-spi/src/test/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtilTest.java?rev=1858836&r1=1858835&r2=1858836&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.8/oak-security-spi/src/test/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtilTest.java
(original)
+++
jackrabbit/oak/branches/1.8/oak-security-spi/src/test/java/org/apache/jackrabbit/oak/spi/security/user/util/PasswordUtilTest.java
Tue May 7 09:53:00 2019
@@ -33,6 +33,7 @@ import static org.junit.Assert.assertEqu
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeFalse;
public class PasswordUtilTest {
@@ -115,6 +116,7 @@ public class PasswordUtilTest {
@Test
public void testBuildPasswordHashNoSaltNoIterations() throws Exception {
+
assumeFalse(PasswordUtil.DEFAULT_ALGORITHM.startsWith(PasswordUtil.PBKDF2_PREFIX));
String jr2Hash = "{"+PasswordUtil.DEFAULT_ALGORITHM+"}" +
Text.digest(PasswordUtil.DEFAULT_ALGORITHM, "pw".getBytes("utf-8"));
assertTrue(PasswordUtil.isSame(jr2Hash, "pw"));
}
@@ -218,16 +220,19 @@ public class PasswordUtilTest {
}
@Test
- public void testPBKDF2WithHmacSHA1() throws Exception {
- String algo = "PBKDF2WithHmacSHA1";
+ public void testPBKDF2With() throws Exception {
+ //
https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html
+ String algo = "PBKDF2WithHmacSHA512";
// test vector from http://tools.ietf.org/html/rfc6070
String pw = "pass\0word";
int iterations = 4096;
String hash = PasswordUtil.buildPasswordHash(pw, algo, 5, iterations);
- assertTrue(hash.startsWith("{PBKDF2WithHmacSHA1}"));
- int cntOctets = hash.substring(hash.lastIndexOf('-')+1).length() / 2;
+ assertTrue(hash.startsWith("{" + algo + "}"));
+ int cntOctets = hash.substring(hash.lastIndexOf('-') + 1).length() / 2;
assertEquals(16, cntOctets);
+
+ assertFalse(PasswordUtil.isPlainTextPassword(hash));
+ assertTrue(PasswordUtil.isSame(hash, pw));
}
-
}
\ No newline at end of file
