https://issues.apache.org/jira/browse/FINERACT-1415 fix (#1908)

* https://issues.apache.org/jira/browse/FINERACT-1415 fix

* https://issues.apache.org/jira/browse/FINERACT-1415 fix

* Fix LF

fineract-provider/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java

@@ -20,8 +20,8 @@ package org.apache.fineract.commands.service;
 
 import com.google.gson.JsonElement;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.security.SecureRandom;
 import java.time.ZonedDateTime;
-import java.util.Random;
 import org.apache.fineract.commands.domain.CommandSource;
 import org.apache.fineract.commands.domain.CommandSourceRepository;
 import org.apache.fineract.commands.domain.CommandWrapper;
@@ -53,7 +53,7 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
     private final CommandProcessingService processAndLogCommandService;
     private final SchedulerJobRunnerReadService schedulerJobRunnerReadService;
     private static final Logger LOG = LoggerFactory.getLogger(PortfolioCommandSourceWritePlatformServiceImpl.class);
-    private static final Random random = new Random();
+    private static final SecureRandom random = new SecureRandom();
 
     @Autowired
     public PortfolioCommandSourceWritePlatformServiceImpl(final PlatformSecurityContext context,

fineract-provider/src/main/java/org/apache/fineract/infrastructure/documentmanagement/contentrepository/ContentRepositoryUtils.java

@@ -19,9 +19,9 @@
 package org.apache.fineract.infrastructure.documentmanagement.contentrepository;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Random;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.fineract.infrastructure.core.data.ApiParameterError;
 import org.apache.fineract.infrastructure.core.domain.Base64EncodedImage;
@@ -32,7 +32,7 @@ import org.apache.fineract.infrastructure.documentmanagement.exception.ContentMa
 
 public final class ContentRepositoryUtils {
 
-    private static final Random random = new Random();
+    private static final SecureRandom random = new SecureRandom();
 
     private ContentRepositoryUtils() {}
 

fineract-provider/src/main/java/org/apache/fineract/infrastructure/gcm/domain/Sender.java

@@ -65,11 +65,11 @@ import java.io.OutputStream;
 import java.net.HttpURLConnection;
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Random;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.apache.fineract.infrastructure.gcm.GcmConstants;
@@ -89,7 +89,7 @@ public class Sender {
      */
     protected static final int MAX_BACKOFF_DELAY = 1024000;
 
-    protected final Random random = new Random();
+    private final SecureRandom random = new SecureRandom();
     protected static final Logger LOG = Logger.getLogger(Sender.class.getName());
 
     private final String key;

fineract-provider/src/main/java/org/apache/fineract/infrastructure/jobs/service/SchedulerTriggerListener.java

@@ -19,7 +19,7 @@
 package org.apache.fineract.infrastructure.jobs.service;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-import java.util.Random;
+import java.security.SecureRandom;
 import org.apache.fineract.infrastructure.core.domain.FineractPlatformTenant;
 import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
 import org.apache.fineract.infrastructure.security.service.TenantDetailsService;
@@ -37,7 +37,7 @@ import org.springframework.stereotype.Component;
 public class SchedulerTriggerListener implements TriggerListener {
 
     private static final Logger LOG = LoggerFactory.getLogger(SchedulerTriggerListener.class);
-    private static final Random random = new Random();
+    private static final SecureRandom random = new SecureRandom();
 
     private final SchedularWritePlatformService schedularService;
     private final TenantDetailsService tenantDetailsService;

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/service/RandomOTPGenerator.java

@@ -18,10 +18,13 @@
  */
 package org.apache.fineract.infrastructure.security.service;
 
+import java.security.SecureRandom;
+
 public class RandomOTPGenerator {
 
     private static final String allowedCharacters = "0123456789ABCDEFGHIJKLMNOPQRSTUVQXYZ";
     private final int tokenLength;
+    private static final SecureRandom random = new SecureRandom();
 
     public RandomOTPGenerator(int tokenLength) {
         this.tokenLength = tokenLength;
@@ -30,7 +33,7 @@ public class RandomOTPGenerator {
     public String generate() {
         StringBuilder builder = new StringBuilder();
         for (int i = 0; i < tokenLength; i++) {
-            builder.append(allowedCharacters.charAt((int) (Math.random() * allowedCharacters.length())));
+            builder.append(allowedCharacters.charAt((int) (random.nextDouble() * allowedCharacters.length())));
         }
 
         return builder.toString();

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/service/RandomPasswordGenerator.java

@@ -18,9 +18,12 @@
  */
 package org.apache.fineract.infrastructure.security.service;
 
+import java.security.SecureRandom;
+
 public class RandomPasswordGenerator {
 
     private final int numberOfCharactersInPassword;
+    private static final SecureRandom random = new SecureRandom();
 
     public RandomPasswordGenerator(final int numberOfCharactersInPassword) {
         this.numberOfCharactersInPassword = numberOfCharactersInPassword;
@@ -30,7 +33,7 @@ public class RandomPasswordGenerator {
 
         final StringBuilder passwordBuilder = new StringBuilder(this.numberOfCharactersInPassword);
         for (int i = 0; i < this.numberOfCharactersInPassword; i++) {
-            passwordBuilder.append((char) ((int) (Math.random() * 26) + 97));
+            passwordBuilder.append((char) ((int) (random.nextDouble() * 26) + 97));
         }
         return passwordBuilder.toString();
     }

fineract-provider/src/main/java/org/apache/fineract/portfolio/loanaccount/service/LoanSchedularServiceImpl.java

@@ -19,13 +19,13 @@
 package org.apache.fineract.portfolio.loanaccount.service;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Random;
 import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
@@ -56,7 +56,7 @@ import org.springframework.util.CollectionUtils;
 public class LoanSchedularServiceImpl implements LoanSchedularService {
 
     private static final Logger LOG = LoggerFactory.getLogger(LoanSchedularServiceImpl.class);
-    private static final Random random = new Random();
+    private static final SecureRandom random = new SecureRandom();
 
     private final ConfigurationDomainService configurationDomainService;
     private final LoanReadPlatformService loanReadPlatformService;

fineract-provider/src/main/java/org/apache/fineract/portfolio/loanaccount/service/RecalculateInterestPoster.java

@@ -19,10 +19,10 @@
 package org.apache.fineract.portfolio.loanaccount.service;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
-import java.util.Random;
 import java.util.concurrent.Callable;
 import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
 import org.apache.fineract.infrastructure.jobs.exception.JobExecutionException;
@@ -38,7 +38,7 @@ import org.springframework.stereotype.Component;
 public class RecalculateInterestPoster implements Callable<Void> {
 
     private static final Logger LOG = LoggerFactory.getLogger(RecalculateInterestPoster.class);
-    private static final Random random = new Random();
+    private static final SecureRandom random = new SecureRandom();
 
     private Collection<Long> loanIds;
     private LoanWritePlatformService loanWritePlatformService;
@@ -81,7 +81,6 @@ public class RecalculateInterestPoster implements Callable<Void> {
                         // Else sleep for a random time (between 1 to 10
                         // seconds) and continue
                         try {
-                            Random random = new Random();
                             int randomNum = random.nextInt(maxIntervalBetweenRetries + 1);
                             Thread.sleep(1000 + (randomNum * 1000));
                             numberOfRetries = numberOfRetries + 1;

fineract-provider/src/main/java/org/apache/fineract/portfolio/self/registration/service/SelfServiceRegistrationWritePlatformServiceImpl.java

@@ -22,6 +22,7 @@ import com.google.gson.Gson;
 import com.google.gson.JsonElement;
 import com.google.gson.reflect.TypeToken;
 import java.lang.reflect.Type;
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -86,6 +87,7 @@ public class SelfServiceRegistrationWritePlatformServiceImpl implements SelfServ
     private final SmsCampaignDropdownReadPlatformService smsCampaignDropdownReadPlatformService;
     private final AppUserReadPlatformService appUserReadPlatformService;
     private final RoleRepository roleRepository;
+    private static final SecureRandom random = new SecureRandom();
 
     @Autowired
     public SelfServiceRegistrationWritePlatformServiceImpl(final SelfServiceRegistrationRepository selfServiceRegistrationRepository,
@@ -234,7 +236,7 @@ public class SelfServiceRegistrationWritePlatformServiceImpl implements SelfServ
     }
 
     public static String randomAuthorizationTokenGeneration() {
-        Integer randomPIN = (int) (Math.random() * 9000) + 1000;
+        Integer randomPIN = (int) (random.nextDouble() * 9000) + 1000;
         return randomPIN.toString();
     }
 

integration-tests/src/test/java/org/apache/fineract/integrationtests/AuditIntegrationTest.java

@@ -24,10 +24,10 @@ import io.restassured.builder.ResponseSpecBuilder;
 import io.restassured.http.ContentType;
 import io.restassured.specification.RequestSpecification;
 import io.restassured.specification.ResponseSpecification;
+import java.security.SecureRandom;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
-import java.util.Random;
 import org.apache.fineract.integrationtests.common.AuditHelper;
 import org.apache.fineract.integrationtests.common.ClientHelper;
 import org.apache.fineract.integrationtests.common.OfficeHelper;
@@ -46,7 +46,7 @@ public class AuditIntegrationTest {
     private RequestSpecification requestSpec;
     private ClientHelper clientHelper;
     private AuditHelper auditHelper;
-    private static final Random rand = new Random();
+    private static final SecureRandom rand = new SecureRandom();
 
     /**
      * Sets up the essential settings for the TEST like contentType, expectedStatusCode. It uses the '@BeforeEach'

integration-tests/src/test/java/org/apache/fineract/integrationtests/BatchRequestsIntegrationTest.java

@@ -23,6 +23,7 @@ import io.restassured.builder.ResponseSpecBuilder;
 import io.restassured.http.ContentType;
 import io.restassured.specification.RequestSpecification;
 import io.restassured.specification.ResponseSpecification;
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.fineract.batch.domain.BatchRequest;
@@ -51,6 +52,7 @@ public class BatchRequestsIntegrationTest {
     private static final Logger LOG = LoggerFactory.getLogger(BatchRequestsIntegrationTest.class);
     private ResponseSpecification responseSpec;
     private RequestSpecification requestSpec;
+    private static final SecureRandom random = new SecureRandom();
 
     public BatchRequestsIntegrationTest() {
 
@@ -79,7 +81,7 @@ public class BatchRequestsIntegrationTest {
     public void shouldReturnOkStatusForLoansAppliedToSelectedClients() {
 
         // Generate a random count of number of clients to be created
-        final Integer clientsCount = (int) Math.ceil(Math.random() * 7) + 3;
+        final Integer clientsCount = (int) Math.ceil(random.nextDouble() * 7) + 3;
         final Integer[] clientIDs = new Integer[clientsCount];
 
         // Create a new group and get its groupId
@@ -93,17 +95,17 @@ public class BatchRequestsIntegrationTest {
         }
 
         // Generate a random count of number of new loan products to be created
-        final Integer loansCount = (int) Math.ceil(Math.random() * 4) + 1;
+        final Integer loansCount = (int) Math.ceil(random.nextDouble() * 4) + 1;
         final Integer[] loanProducts = new Integer[loansCount];
 
         // Create new loan Products
         for (Integer i = 0; i < loansCount; i++) {
             final String loanProductJSON = new LoanProductTestBuilder() //
-                    .withPrincipal(String.valueOf(10000.00 + Math.ceil(Math.random() * 1000000.00))) //
+                    .withPrincipal(String.valueOf(10000.00 + Math.ceil(random.nextDouble() * 1000000.00))) //
-                    .withNumberOfRepayments(String.valueOf(2 + (int) Math.ceil(Math.random() * 36))) //
+                    .withNumberOfRepayments(String.valueOf(2 + (int) Math.ceil(random.nextDouble() * 36))) //
-                    .withRepaymentAfterEvery(String.valueOf(1 + (int) Math.ceil(Math.random() * 3))) //
+                    .withRepaymentAfterEvery(String.valueOf(1 + (int) Math.ceil(random.nextDouble() * 3))) //
                     .withRepaymentTypeAsMonth() //
-                    .withinterestRatePerPeriod(String.valueOf(1 + (int) Math.ceil(Math.random() * 4))) //
+                    .withinterestRatePerPeriod(String.valueOf(1 + (int) Math.ceil(random.nextDouble() * 4))) //
                     .withInterestRateFrequencyTypeAsMonths() //
                     .withAmortizationTypeAsEqualPrincipalPayment() //
                     .withInterestTypeAsDecliningBalance() //
@@ -113,22 +115,23 @@ public class BatchRequestsIntegrationTest {
         }
 
         // Select anyone of the loan products at random
-        final Integer loanProductID = loanProducts[(int) Math.floor(Math.random() * (loansCount - 1))];
+        final Integer loanProductID = loanProducts[(int) Math.floor(random.nextDouble() * (loansCount - 1))];
 
         final List<BatchRequest> batchRequests = new ArrayList<>();
 
         // Select a few clients from created group at random
-        Integer selClientsCount = (int) Math.ceil(Math.random() * clientsCount) + 2;
+        Integer selClientsCount = (int) Math.ceil(random.nextDouble() * clientsCount) + 2;
         for (int i = 0; i < selClientsCount; i++) {
 
             final Integer collateralId = CollateralManagementHelper.createCollateralProduct(this.requestSpec, this.responseSpec);
             Assertions.assertNotNull(collateralId);
             final Integer clientCollateralId = CollateralManagementHelper.createClientCollateral(this.requestSpec, this.responseSpec,
-                    String.valueOf(clientIDs[(int) Math.floor(Math.random() * (clientsCount - 1))]), collateralId);
+                    String.valueOf(clientIDs[(int) Math.floor(random.nextDouble() * (clientsCount - 1))]), collateralId);
             Assertions.assertNotNull(clientCollateralId);
 
             BatchRequest br = BatchHelper.applyLoanRequest((long) selClientsCount, null, loanProductID, clientCollateralId);
-            br.setBody(br.getBody().replace("$.clientId", String.valueOf(clientIDs[(int) Math.floor(Math.random() * (clientsCount - 1))])));
+            br.setBody(br.getBody().replace("$.clientId",
+                    String.valueOf(clientIDs[(int) Math.floor(random.nextDouble() * (clientsCount - 1))])));
             batchRequests.add(br);
         }
 

integration-tests/src/test/java/org/apache/fineract/integrationtests/ClientTest.java

@@ -26,9 +26,9 @@ import io.restassured.builder.ResponseSpecBuilder;
 import io.restassured.http.ContentType;
 import io.restassured.specification.RequestSpecification;
 import io.restassured.specification.ResponseSpecification;
+import java.security.SecureRandom;
 import java.util.HashMap;
 import java.util.List;
-import java.util.Random;
 import org.apache.fineract.integrationtests.common.ClientHelper;
 import org.apache.fineract.integrationtests.common.Utils;
 import org.junit.jupiter.api.BeforeEach;
@@ -39,7 +39,7 @@ public class ClientTest {
     private ResponseSpecification responseSpec;
     private RequestSpecification requestSpec;
     private ClientHelper clientHelper;
-    private static final Random rand = new Random();
+    private static final SecureRandom rand = new SecureRandom();
 
     @BeforeEach
     public void setup() {

integration-tests/src/test/java/org/apache/fineract/integrationtests/client/IntegrationTest.java

@@ -33,8 +33,8 @@ import com.google.common.truth.Truth;
 import com.google.common.truth.Truth8;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.math.BigDecimal;
+import java.security.SecureRandom;
 import java.util.Optional;
-import java.util.Random;
 import okhttp3.logging.HttpLoggingInterceptor.Level;
 import org.apache.fineract.client.util.Calls;
 import org.apache.fineract.client.util.FineractClient;
@@ -56,7 +56,7 @@ import retrofit2.Response;
 @TestMethodOrder(MethodOrderer.OrderAnnotation.class)
 public abstract class IntegrationTest {
 
-    private static final Random random = new Random();
+    private static final SecureRandom random = new SecureRandom();
 
     private FineractClient fineract;
 

integration-tests/src/test/java/org/apache/fineract/integrationtests/common/Utils.java

@@ -31,6 +31,7 @@ import io.restassured.response.Response;
 import io.restassured.specification.RequestSpecification;
 import io.restassured.specification.ResponseSpecification;
 import java.io.File;
+import java.security.SecureRandom;
 import java.text.DateFormat;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
@@ -38,7 +39,6 @@ import java.time.LocalDate;
 import java.time.ZoneId;
 import java.util.Calendar;
 import java.util.Locale;
-import java.util.Random;
 import java.util.TimeZone;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.fineract.infrastructure.core.service.DateUtils;
@@ -58,7 +58,7 @@ public final class Utils {
     }
 
     private static final Logger LOG = LoggerFactory.getLogger(Utils.class);
-    private static final Random random = new Random();
+    private static final SecureRandom random = new SecureRandom();
 
     public static final String TENANT_PARAM_NAME = "tenantIdentifier";
     public static final String DEFAULT_TENANT = "default";

integration-tests/src/test/java/org/apache/fineract/integrationtests/common/WorkingDaysHelper.java

@@ -22,8 +22,8 @@ import com.google.gson.Gson;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import io.restassured.specification.RequestSpecification;
 import io.restassured.specification.ResponseSpecification;
+import java.security.SecureRandom;
 import java.util.HashMap;
-import java.util.Random;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -35,7 +35,7 @@ public final class WorkingDaysHelper {
 
     private static final Logger LOG = LoggerFactory.getLogger(WorkingDaysHelper.class);
     private static final String WORKINGDAYS_URL = "/fineract-provider/api/v1/workingdays";
-    private static final Random random = new Random();
+    private static final SecureRandom random = new SecureRandom();
 
     public static Object updateWorkingDays(final RequestSpecification requestSpec, final ResponseSpecification responseSpec) {
         final String UPDATE_WORKINGDAYS_URL = WORKINGDAYS_URL + "?" + Utils.TENANT_IDENTIFIER;

integration-tests/src/test/java/org/apache/fineract/integrationtests/common/provisioning/ProvisioningHelper.java

@@ -20,20 +20,20 @@ package org.apache.fineract.integrationtests.common.provisioning;
 
 import com.google.gson.Gson;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.security.SecureRandom;
 import java.text.DateFormat;
 import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.Map;
-import java.util.Random;
 import org.apache.fineract.infrastructure.core.service.DateUtils;
 import org.apache.fineract.integrationtests.common.Utils;
 import org.apache.fineract.integrationtests.common.accounting.Account;
 
 public final class ProvisioningHelper {
 
-    private static final Random rand = new Random();
+    private static final SecureRandom rand = new SecureRandom();
 
     private ProvisioningHelper() {