[java-support] branch master updated: Relax DataSealer requirement for data expiration.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-support.

View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=03b8dc97f7da4af03376380d0e79f8d3f342d34b

The following commit(s) were added to refs/heads/master by this push:
       new  03b8dc9   Relax DataSealer requirement for data expiration.
03b8dc9 is described below

commit 03b8dc97f7da4af03376380d0e79f8d3f342d34b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 30 10:31:03 2020 -0400

    Relax DataSealer requirement for data expiration.
---
 .../utilities/java/support/security/DataSealer.java | 21 +++++++++++++++++----
 .../java/support/security/DataSealerTest.java       | 11 ++++++++++-
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java b/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
index 7d61a4c..2bc88fd 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
@@ -56,6 +56,8 @@ import org.slf4j.LoggerFactory;
 
 /**
  * Applies a MAC to time-limited information and encrypts with a symmetric key.
+ * 
+ * TODO: make final
  */
 public class DataSealer extends AbstractInitializableComponent {
 
@@ -269,7 +271,7 @@ public class DataSealer extends AbstractInitializableComponent {
                 new DataInputStream(new GZIPInputStream(new ByteArrayInputStream(decryptedBytes)))) {
 
             final long decodedExpirationTime = dataInputStream.readLong();
-            if (System.currentTimeMillis() > decodedExpirationTime) {
+            if (decodedExpirationTime > 0 && System.currentTimeMillis() > decodedExpirationTime) {
                 log.debug("Unwrapped data has expired");
                 throw new DataExpiredException("Unwrapped data has expired");
             }
@@ -295,6 +297,17 @@ public class DataSealer extends AbstractInitializableComponent {
         }
     }
 
+    /**
+     * Equivalent to {@link #wrap(String, Instant)} with expiration set to "never".
+     * 
+     * @param data the data to wrap
+     * @return the encoded blob
+     * @throws DataSealerException if the wrapping operation fails
+     */
+    @Nonnull public String wrap(@Nonnull @NotEmpty final String data) throws DataSealerException {
+        return wrap(data, null);
+    }
+    
     /**
      * Encodes data into an AEAD-encrypted blob, gzip(exp|data)
      * 
@@ -308,11 +321,11 @@ public class DataSealer extends AbstractInitializableComponent {
      * (in length-prefixed UTF-8 format), which identifies the key used. Finally the result is base64-encoded.</p>
      * 
      * @param data the data to wrap
-     * @param exp expiration time
+     * @param exp expiration time or null for none
      * @return the encoded blob
      * @throws DataSealerException if the wrapping operation fails
      */
-    @Nonnull public String wrap(@Nonnull @NotEmpty final String data, @Nonnull final Instant exp)
+    @Nonnull public String wrap(@Nonnull @NotEmpty final String data, @Nullable final Instant exp)
             throws DataSealerException {
 
         if (data == null || data.length() == 0) {
@@ -335,7 +348,7 @@ public class DataSealer extends AbstractInitializableComponent {
                     final GZIPOutputStream compressedStream = new GZIPOutputStream(byteStream);
                     final DataOutputStream dataStream = new DataOutputStream(compressedStream)) {
 
-                dataStream.writeLong(exp.toEpochMilli());
+                dataStream.writeLong(exp != null ? exp.toEpochMilli() : 0);
 
                 int count = 0;
                 int start = 0;
diff --git a/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java b/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java
index afd6271..ca79fff 100644
--- a/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java
+++ b/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java
@@ -104,10 +104,19 @@ public class DataSealerTest {
         sealer.initialize();
         return sealer;
     }
-    
+
     @Test public void encodeDecode() throws DataSealerException, ComponentInitializationException {
         final DataSealer sealer = createDataSealer();
 
+        final String encoded = sealer.wrap(THE_DATA);
+        final StringBuffer alias = new StringBuffer(); 
+        Assert.assertEquals(sealer.unwrap(encoded, alias), THE_DATA);
+        Assert.assertEquals(alias.toString(), "secret1");
+    }
+
+    @Test public void encodeDecodeWithExp() throws DataSealerException, ComponentInitializationException {
+        final DataSealer sealer = createDataSealer();
+
         final String encoded = sealer.wrap(THE_DATA, Instant.now().plusSeconds(50));
         final StringBuffer alias = new StringBuffer(); 
         Assert.assertEquals(sealer.unwrap(encoded, alias), THE_DATA);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.