[java-identity-provider] branch main updated: IDP-1737 - Replace calls to cryptacular base64/sha2 code
Scott Cantor
cantor.2 at osu.edu
Thu Jan 14 23:25:11 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0389b31c2b6122cfa40d3d6c45e7aa856761dab8
The following commit(s) were added to refs/heads/main by this push:
new 0389b31c2 IDP-1737 - Replace calls to cryptacular base64/sha2 code
0389b31c2 is described below
commit 0389b31c2b6122cfa40d3d6c45e7aa856761dab8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 14 18:24:36 2021 -0500
IDP-1737 - Replace calls to cryptacular base64/sha2 code
https://issues.shibboleth.net/jira/browse/IDP-1737
---
.../logic/impl/AttributeValuesHashFunction.java | 15 ++++---
.../idp/consent/logic/impl/HashFunction.java | 48 ----------------------
.../logic/impl/MessageSourceConsentFunction.java | 33 ++++++++++++++-
.../idp/consent/logic/impl/HashFunctionTest.java | 45 --------------------
.../impl/MessageSourceConsentFunctionTest.java | 22 ++++------
5 files changed, 50 insertions(+), 113 deletions(-)
diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeValuesHashFunction.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeValuesHashFunction.java
index 85a1378d4..2f48f647c 100644
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeValuesHashFunction.java
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeValuesHashFunction.java
@@ -20,6 +20,8 @@ package net.shibboleth.idp.consent.logic.impl;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
import java.util.Collection;
import java.util.List;
import java.util.function.Function;
@@ -27,8 +29,6 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.cryptacular.util.CodecUtil;
-import org.cryptacular.util.HashUtil;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.core.xml.io.MarshallingException;
import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -43,6 +43,8 @@ import net.shibboleth.idp.attribute.ScopedStringAttributeValue;
import net.shibboleth.idp.attribute.StringAttributeValue;
import net.shibboleth.idp.attribute.XMLObjectAttributeValue;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.codec.Base64Support;
+import net.shibboleth.utilities.java.support.codec.EncodingException;
import net.shibboleth.utilities.java.support.xml.SerializeSupport;
/**
@@ -71,7 +73,7 @@ public class AttributeValuesHashFunction implements Function<Collection<IdPAttri
if (filteredInput.isEmpty()) {
return null;
}
-
+
try (final ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
final ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream)) {
@@ -117,9 +119,12 @@ public class AttributeValuesHashFunction implements Function<Collection<IdPAttri
}
objectOutputStream.flush();
- return CodecUtil.b64(HashUtil.sha256(byteArrayOutputStream.toByteArray()));
- } catch (final IOException e) {
+ final MessageDigest digest = MessageDigest.getInstance("SHA-256");
+ final byte[] digestedBytes = digest.digest(byteArrayOutputStream.toByteArray());
+ return Base64Support.encode(digestedBytes, false);
+
+ } catch (final IOException | NoSuchAlgorithmException | EncodingException e) {
log.error("Error while converting attribute values into a byte array", e);
return null;
}
diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/HashFunction.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/HashFunction.java
deleted file mode 100644
index 91d10ffa6..000000000
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/HashFunction.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.consent.logic.impl;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.cryptacular.util.CodecUtil;
-import org.cryptacular.util.HashUtil;
-
-/**
- * Function whose output value is a hash of the input value.
- *
- * Returns <code>null</code> for a <code>null</code> input.
- *
- * The hash returned is the Base64 encoded representation of the SHA-256 digest.
- */
-public class HashFunction implements Function<String, String> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public String apply(@Nonnull final String input) {
-
- if (input == null) {
- return null;
- }
-
- // TODO: replace these with more standard calls
- return CodecUtil.b64(HashUtil.sha256(input));
- }
-}
\ No newline at end of file
diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/MessageSourceConsentFunction.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/MessageSourceConsentFunction.java
index 50a915513..405cf11af 100644
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/MessageSourceConsentFunction.java
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/MessageSourceConsentFunction.java
@@ -17,6 +17,7 @@
package net.shibboleth.idp.consent.logic.impl;
+import java.security.NoSuchAlgorithmException;
import java.util.Collections;
import java.util.Locale;
import java.util.Map;
@@ -28,8 +29,12 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.consent.Consent;
import net.shibboleth.idp.consent.flow.impl.ConsentFlowDescriptor;
import net.shibboleth.idp.profile.context.navigate.RelyingPartyIdLookupFunction;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.codec.StringDigester;
+import net.shibboleth.utilities.java.support.codec.StringDigester.OutputFormat;
import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
@@ -59,7 +64,7 @@ public class MessageSourceConsentFunction extends AbstractInitializableComponent
@Nonnull private Function<ProfileRequestContext,ConsentFlowDescriptor> consentFlowDescriptorLookupStrategy;
/** Function used to create a hash of the consent value. */
- @Nonnull private Function<String,String> hashFunction;
+ @NonnullAfterInit private Function<String,String> hashFunction;
/** Locale lookup strategy. */
@Nonnull private Function<ProfileRequestContext,Locale> localeLookupStrategy;
@@ -73,7 +78,6 @@ public class MessageSourceConsentFunction extends AbstractInitializableComponent
consentValueMessageCodeSuffix = ".text";
consentFlowDescriptorLookupStrategy =
new FlowDescriptorLookupFunction<>(ConsentFlowDescriptor.class);
- hashFunction = new HashFunction();
localeLookupStrategy = new LocaleLookupFunction();
}
@@ -119,6 +123,17 @@ public class MessageSourceConsentFunction extends AbstractInitializableComponent
consentFlowDescriptorLookupStrategy =
Constraint.isNotNull(strategy, "Consent flow descriptor lookup strategy cannot be null");
}
+
+ /**
+ * Get the hash function.
+ *
+ * @return hash function
+ *
+ * @since 4.1.0
+ */
+ @NonnullAfterInit Function<String,String> getHashFunction() {
+ return hashFunction;
+ }
/**
* Set the hash function.
@@ -140,6 +155,20 @@ public class MessageSourceConsentFunction extends AbstractInitializableComponent
localeLookupStrategy = Constraint.isNotNull(strategy, "Locale lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (hashFunction == null) {
+ try {
+ hashFunction = new StringDigester("SHA-256", OutputFormat.BASE64);
+ } catch (final NoSuchAlgorithmException e) {
+ throw new ComponentInitializationException(e);
+ }
+ }
+ }
+
/** {@inheritDoc} */
@Nullable public Map<String,Consent> apply(@Nullable final ProfileRequestContext input) {
if (input == null) {
diff --git a/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/logic/impl/HashFunctionTest.java b/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/logic/impl/HashFunctionTest.java
deleted file mode 100644
index 728582202..000000000
--- a/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/logic/impl/HashFunctionTest.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.consent.logic.impl;
-
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/** {@link HashFunction} unit test. */
-public class HashFunctionTest {
-
- private HashFunction function;
-
- @BeforeMethod public void setUp() {
- function = new HashFunction();
- }
-
- @Test public void testNullInput() {
- Assert.assertNull(function.apply(null));
- }
-
- @Test public void testEmptyInput() {
- Assert.assertEquals(function.apply(""), "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=");
- }
-
- @Test public void testHash() {
- Assert.assertEquals(function.apply("foo"), "LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564=");
- }
-
-}
diff --git a/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/logic/impl/MessageSourceConsentFunctionTest.java b/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/logic/impl/MessageSourceConsentFunctionTest.java
index 3dca6f974..685d090f2 100644
--- a/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/logic/impl/MessageSourceConsentFunctionTest.java
+++ b/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/logic/impl/MessageSourceConsentFunctionTest.java
@@ -48,8 +48,6 @@ public class MessageSourceConsentFunctionTest {
private MessageSource messageSource;
- private HashFunction hashFunction;
-
private MessageSourceConsentFunction function;
@BeforeMethod public void setUp() throws Exception {
@@ -58,8 +56,6 @@ public class MessageSourceConsentFunctionTest {
messageSource = new MockMessageSource();
- hashFunction = new HashFunction();
-
function = new MessageSourceConsentFunction();
function.setMessageSource(messageSource);
}
@@ -109,25 +105,25 @@ public class MessageSourceConsentFunctionTest {
@Test(expectedExceptions = UnmodifiableComponentException.class) public void testInstantiationIdMessageCode()
throws Exception {
- function.setConsentKeyLookupStrategy(FunctionSupport.<ProfileRequestContext,String>constant("consentIdMessageCode"));
+ function.setConsentKeyLookupStrategy(FunctionSupport.constant("consentIdMessageCode"));
function.initialize();
- function.setConsentKeyLookupStrategy(FunctionSupport.<ProfileRequestContext,String>constant("consentIdMessageCode"));
+ function.setConsentKeyLookupStrategy(FunctionSupport.constant("consentIdMessageCode"));
}
@Test public void testMessageSourceConsent() throws Exception {
setUpDescriptor(false);
+ function.setConsentKeyLookupStrategy(FunctionSupport.constant("key"));
+ function.initialize();
+
final Consent consent = new Consent();
consent.setId("id");
final Map<String, Consent> expected = new HashMap<>();
expected.put(consent.getId(), consent);
- function.setConsentKeyLookupStrategy(FunctionSupport.<ProfileRequestContext,String>constant("key"));
- function.initialize();
-
Assert.assertEquals(function.apply(prc), expected);
}
@@ -135,16 +131,16 @@ public class MessageSourceConsentFunctionTest {
setUpDescriptor(true);
+ function.setConsentKeyLookupStrategy(FunctionSupport.constant("key"));
+ function.initialize();
+
final Consent consent = new Consent();
consent.setId("id");
- consent.setValue(hashFunction.apply("value"));
+ consent.setValue(function.getHashFunction().apply("value"));
final Map<String, Consent> expected = new HashMap<>();
expected.put(consent.getId(), consent);
- function.setConsentKeyLookupStrategy(FunctionSupport.<ProfileRequestContext,String>constant("key"));
- function.initialize();
-
Assert.assertEquals(function.apply(prc), expected);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list