Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id BB3FC200BF0 for ; Fri, 30 Dec 2016 17:30:10 +0100 (CET) Received: by cust-asf.ponee.io (Postfix) id B9C3D160B32; Fri, 30 Dec 2016 16:30:10 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 102C3160B19 for ; Fri, 30 Dec 2016 17:30:09 +0100 (CET) Received: (qmail 62008 invoked by uid 500); 30 Dec 2016 16:30:09 -0000 Mailing-List: contact commits-help@cxf.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@cxf.apache.org Delivered-To: mailing list commits@cxf.apache.org Received: (qmail 61998 invoked by uid 99); 30 Dec 2016 16:30:09 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 30 Dec 2016 16:30:09 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id 2E6C1DFC15; Fri, 30 Dec 2016 16:30:09 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: sergeyb@apache.org To: commits@cxf.apache.org Message-Id: <5146ae9edcaf4011ba27085315e523d4@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: cxf git commit: Doing a better bytes comparison in some of JAXRS OAuth2/Jose code Date: Fri, 30 Dec 2016 16:30:09 +0000 (UTC) archived-at: Fri, 30 Dec 2016 16:30:10 -0000 Repository: cxf Updated Branches: refs/heads/3.0.x-fixes 4a89a4870 -> 1338469f7 Doing a better bytes comparison in some of JAXRS OAuth2/Jose code Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/1338469f Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/1338469f Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/1338469f Branch: refs/heads/3.0.x-fixes Commit: 1338469f7d25cfcda75b547c68bed95bd97903ac Parents: 4a89a48 Author: Sergey Beryozkin Authored: Fri Dec 30 16:27:03 2016 +0000 Committer: Sergey Beryozkin Committed: Fri Dec 30 16:29:30 2016 +0000 ---------------------------------------------------------------------- .../apache/cxf/rs/security/jose/jwe/AesCbcHmacJweDecryption.java | 4 ++-- .../cxf/rs/security/jose/jws/HmacJwsSignatureVerifier.java | 4 ++-- .../oauth2/tokens/hawk/AbstractHawkAccessTokenValidator.java | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/1338469f/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/AesCbcHmacJweDecryption.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/AesCbcHmacJweDecryption.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/AesCbcHmacJweDecryption.java index e713ff0..a0f1bfd 100644 --- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/AesCbcHmacJweDecryption.java +++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/AesCbcHmacJweDecryption.java @@ -18,8 +18,8 @@ */ package org.apache.cxf.rs.security.jose.jwe; +import java.security.MessageDigest; import java.security.spec.AlgorithmParameterSpec; -import java.util.Arrays; import javax.crypto.spec.IvParameterSpec; @@ -56,7 +56,7 @@ public class AesCbcHmacJweDecryption extends JweDecryption { jweDecryptionInput.getDecodedJsonHeaders()); macState.mac.update(jweDecryptionInput.getEncryptedContent()); byte[] expectedAuthTag = AesCbcHmacJweEncryption.signAndGetTag(macState); - if (!Arrays.equals(actualAuthTag, expectedAuthTag)) { + if (!MessageDigest.isEqual(actualAuthTag, expectedAuthTag)) { LOG.warning("Invalid authentication tag"); throw new JweException(JweException.Error.CONTENT_DECRYPTION_FAILURE); } http://git-wip-us.apache.org/repos/asf/cxf/blob/1338469f/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/HmacJwsSignatureVerifier.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/HmacJwsSignatureVerifier.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/HmacJwsSignatureVerifier.java index 7910659..66b5d5c 100644 --- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/HmacJwsSignatureVerifier.java +++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/HmacJwsSignatureVerifier.java @@ -18,8 +18,8 @@ */ package org.apache.cxf.rs.security.jose.jws; +import java.security.MessageDigest; import java.security.spec.AlgorithmParameterSpec; -import java.util.Arrays; import java.util.logging.Logger; import org.apache.cxf.common.logging.LogUtils; @@ -53,7 +53,7 @@ public class HmacJwsSignatureVerifier implements JwsSignatureVerifier { @Override public boolean verify(JwsHeaders headers, String unsignedText, byte[] signature) { byte[] expected = computeMac(headers, unsignedText); - return Arrays.equals(expected, signature); + return MessageDigest.isEqual(expected, signature); } private byte[] computeMac(JwsHeaders headers, String text) { http://git-wip-us.apache.org/repos/asf/cxf/blob/1338469f/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/hawk/AbstractHawkAccessTokenValidator.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/hawk/AbstractHawkAccessTokenValidator.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/hawk/AbstractHawkAccessTokenValidator.java index d9d70a5..aa17a4e 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/hawk/AbstractHawkAccessTokenValidator.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/tokens/hawk/AbstractHawkAccessTokenValidator.java @@ -19,7 +19,7 @@ package org.apache.cxf.rs.security.oauth2.tokens.hawk; import java.net.URI; -import java.util.Arrays; +import java.security.MessageDigest; import java.util.Collections; import java.util.HashMap; import java.util.List; @@ -78,7 +78,7 @@ public abstract class AbstractHawkAccessTokenValidator implements AccessTokenVal String clientMacString = schemeParams.get(OAuthConstants.HAWK_TOKEN_SIGNATURE); byte[] clientMacData = Base64Utility.decode(clientMacString); - boolean validMac = Arrays.equals(serverMacData, clientMacData); + boolean validMac = MessageDigest.isEqual(serverMacData, clientMacData); if (!validMac) { AuthorizationUtils.throwAuthorizationFailure(Collections .singleton(OAuthConstants.HAWK_AUTHORIZATION_SCHEME));