summaryrefslogtreecommitdiff
path: root/eaaf_core_utils
diff options
context:
space:
mode:
authorThomas Lenz <thomas.lenz@egiz.gv.at>2020-12-10 15:01:14 +0100
committerThomas Lenz <thomas.lenz@egiz.gv.at>2020-12-10 15:01:14 +0100
commit6cebc7aa1aecb1bc8f87443887a90fe851893954 (patch)
tree90f9b8b0187a4bb4d033ccd57cc15e72b27791ae /eaaf_core_utils
parenta126c249b8ed83dce4386331a49d04a42b53e448 (diff)
parent360df2054cdc5a8bc194f7701b2bfa5a9c39dd0d (diff)
downloadEAAF-Components-6cebc7aa1aecb1bc8f87443887a90fe851893954.tar.gz
EAAF-Components-6cebc7aa1aecb1bc8f87443887a90fe851893954.tar.bz2
EAAF-Components-6cebc7aa1aecb1bc8f87443887a90fe851893954.zip
Merge branch 'feature/someSmallUpdates' into 'nightlyBuild'
Feature/some small updates See merge request egiz/eaaf_components!6
Diffstat (limited to 'eaaf_core_utils')
-rw-r--r--eaaf_core_utils/checks/spotbugs-exclude.xml25
-rw-r--r--eaaf_core_utils/pom.xml10
-rw-r--r--eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java5
3 files changed, 38 insertions, 2 deletions
diff --git a/eaaf_core_utils/checks/spotbugs-exclude.xml b/eaaf_core_utils/checks/spotbugs-exclude.xml
new file mode 100644
index 00000000..b42f34c2
--- /dev/null
+++ b/eaaf_core_utils/checks/spotbugs-exclude.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FindBugsFilter>
+ <Match>
+ <Class name="at.gv.egiz.eaaf.core.impl.utils.EaafSerializationUtils" />
+ <OR>
+ <Bug pattern="OBJECT_DESERIALIZATION" />
+ </OR>
+ </Match>
+ <Match>
+ <!-- Paths and URLs only loaded from configuration -->
+ <Class name="at.gv.egiz.eaaf.core.impl.utils.FileUtils" />
+ <OR>
+ <Bug pattern="URLCONNECTION_SSRF_FD" />
+ <Bug pattern="PATH_TRAVERSAL_IN" />
+ </OR>
+ </Match>
+ <Match>
+ <!-- Paths and URLs only loaded from configuration -->
+ <Class name="at.gv.egiz.eaaf.core.impl.utils.KeyStoreUtils" />
+ <OR>
+ <Bug pattern="URLCONNECTION_SSRF_FD" />
+ <Bug pattern="PATH_TRAVERSAL_IN" />
+ </OR>
+ </Match>
+</FindBugsFilter> \ No newline at end of file
diff --git a/eaaf_core_utils/pom.xml b/eaaf_core_utils/pom.xml
index 947faf4b..c7cefa8d 100644
--- a/eaaf_core_utils/pom.xml
+++ b/eaaf_core_utils/pom.xml
@@ -181,6 +181,16 @@
</dependencies>
</plugin>
+ <plugin>
+ <groupId>com.github.spotbugs</groupId>
+ <artifactId>spotbugs-maven-plugin</artifactId>
+ <version>${spotbugs-maven-plugin.version}</version>
+ <configuration>
+ <failOnError>true</failOnError>
+ <excludeFilterFile>checks/spotbugs-exclude.xml</excludeFilterFile>
+ </configuration>
+ </plugin>
+
</plugins>
</build>
diff --git a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java
index 8ec5f3a8..cfb4ed88 100644
--- a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java
+++ b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java
@@ -2,8 +2,8 @@ package at.gv.egiz.eaaf.core.impl.utils;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
+import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
-import java.util.Arrays;
import java.util.Base64;
import javax.annotation.PostConstruct;
@@ -109,7 +109,8 @@ public class SecurePendingRequestIdGenerationStrategy
log.trace("Checking HMAC from externalPendingReqId ... ");
final byte[] tokenDigest = Base64.getDecoder().decode(tokenElements[2]);
final byte[] refDigist = calculateHmac(buildInternalToken(internalPendingReqId, timeStamp));
- if (!Arrays.equals(tokenDigest, refDigist)) {
+
+ if (!MessageDigest.isEqual(refDigist,tokenDigest)) {
log.warn("Digest of Token does NOT match");
log.debug("Token: {} | Ref: {}", tokenDigest, refDigist);
throw new PendingReqIdValidationException(null, "internal.pendingreqid.04");