CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 46 Packages Projects Releases Wiki Activity

Make sure that using this pseudorandom number generator is safe (FINERACT-1415)

Browse Source
This commit is contained in:
Victor Romero
2021-10-26 12:28:33 +08:00
committed by Petri Tuomola
parent e6b64858e9
commit a6eef163a9
18 changed files with 53 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java
+2 -2
View File
@@ -20,8 +20,8 @@ package org.apache.fineract.commands.service;
import com.google.gson.JsonElement;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.security.SecureRandom;
import java.time.ZonedDateTime;
import java.util.Random;
import org.apache.fineract.commands.domain.CommandSource;
import org.apache.fineract.commands.domain.CommandSourceRepository;
import org.apache.fineract.commands.domain.CommandWrapper;
@@ -53,7 +53,7 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
private final CommandProcessingService processAndLogCommandService;
private final SchedulerJobRunnerReadService schedulerJobRunnerReadService;
private static final Logger LOG = LoggerFactory.getLogger(PortfolioCommandSourceWritePlatformServiceImpl.class);
private static final Random random = new Random();
private static final SecureRandom random = new SecureRandom();
@Autowired
public PortfolioCommandSourceWritePlatformServiceImpl(final PlatformSecurityContext context,
fineract-provider/src/main/java/org/apache/fineract/infrastructure/documentmanagement/contentrepository/ContentRepositoryUtils.java
+2 -2
View File
@@ -19,9 +19,9 @@
package org.apache.fineract.infrastructure.documentmanagement.contentrepository;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.List;
import java.util.Random;
import org.apache.commons.lang3.StringUtils;
import org.apache.fineract.infrastructure.core.data.ApiParameterError;
import org.apache.fineract.infrastructure.core.domain.Base64EncodedImage;
@@ -32,7 +32,7 @@ import org.apache.fineract.infrastructure.documentmanagement.exception.ContentMa
public final class ContentRepositoryUtils {
private static final Random random = new Random();
private static final SecureRandom random = new SecureRandom();
private ContentRepositoryUtils() {}
fineract-provider/src/main/java/org/apache/fineract/infrastructure/gcm/domain/Sender.java
+2 -2
View File
@@ -65,11 +65,11 @@ import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Random;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.apache.fineract.infrastructure.gcm.GcmConstants;
@@ -89,7 +89,7 @@ public class Sender {
*/
protected static final int MAX_BACKOFF_DELAY = 1024000;
protected final Random random = new Random();
private static final SecureRandom random = new SecureRandom();
protected static final Logger LOG = Logger.getLogger(Sender.class.getName());
private final String key;
fineract-provider/src/main/java/org/apache/fineract/infrastructure/jobs/service/SchedulerTriggerListener.java
+2 -2
View File
@@ -19,7 +19,7 @@
package org.apache.fineract.infrastructure.jobs.service;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.util.Random;
import java.security.SecureRandom;
import org.apache.fineract.infrastructure.core.domain.FineractPlatformTenant;
import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
import org.apache.fineract.infrastructure.security.service.TenantDetailsService;
@@ -37,7 +37,7 @@ import org.springframework.stereotype.Component;
public class SchedulerTriggerListener implements TriggerListener {
private static final Logger LOG = LoggerFactory.getLogger(SchedulerTriggerListener.class);
private static final Random random = new Random();
private static final SecureRandom random = new SecureRandom();
private final SchedularWritePlatformService schedularService;
private final TenantDetailsService tenantDetailsService;
fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/service/RandomOTPGenerator.java
+4 -1
View File
@@ -18,10 +18,13 @@
*/
package org.apache.fineract.infrastructure.security.service;
import java.security.SecureRandom;
public class RandomOTPGenerator {
private static final String allowedCharacters = "0123456789ABCDEFGHIJKLMNOPQRSTUVQXYZ";
private final int tokenLength;
private final SecureRandom secureRandom = new SecureRandom();
public RandomOTPGenerator(int tokenLength) {
this.tokenLength = tokenLength;
@@ -30,7 +33,7 @@ public class RandomOTPGenerator {
public String generate() {
StringBuilder builder = new StringBuilder();
for (int i = 0; i < tokenLength; i++) {
builder.append(allowedCharacters.charAt((int) (Math.random() * allowedCharacters.length())));
builder.append(allowedCharacters.charAt((int) (secureRandom.nextDouble() * allowedCharacters.length())));
}
return builder.toString();
fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/service/RandomPasswordGenerator.java
+4 -1
View File
@@ -18,9 +18,12 @@
*/
package org.apache.fineract.infrastructure.security.service;
import java.security.SecureRandom;
public class RandomPasswordGenerator {
private final int numberOfCharactersInPassword;
private static final SecureRandom secureRandom = new SecureRandom();
public RandomPasswordGenerator(final int numberOfCharactersInPassword) {
this.numberOfCharactersInPassword = numberOfCharactersInPassword;
@@ -30,7 +33,7 @@ public class RandomPasswordGenerator {
final StringBuilder passwordBuilder = new StringBuilder(this.numberOfCharactersInPassword);
for (int i = 0; i < this.numberOfCharactersInPassword; i++) {
passwordBuilder.append((char) ((int) (Math.random() * 26) + 97));
passwordBuilder.append((char) ((int) (secureRandom.nextDouble() * 26) + 97));
}
return passwordBuilder.toString();
}
fineract-provider/src/main/java/org/apache/fineract/portfolio/loanaccount/service/LoanSchedularServiceImpl.java
+2 -2
View File
@@ -19,13 +19,13 @@
package org.apache.fineract.portfolio.loanaccount.service;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Random;
import java.util.concurrent.Callable;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.ExecutorService;
@@ -56,7 +56,7 @@ import org.springframework.util.CollectionUtils;
public class LoanSchedularServiceImpl implements LoanSchedularService {
private static final Logger LOG = LoggerFactory.getLogger(LoanSchedularServiceImpl.class);
private static final Random random = new Random();
private static final SecureRandom random = new SecureRandom();
private final ConfigurationDomainService configurationDomainService;
private final LoanReadPlatformService loanReadPlatformService;
fineract-provider/src/main/java/org/apache/fineract/portfolio/loanaccount/service/RecalculateInterestPoster.java
+2 -3
View File
@@ -19,10 +19,10 @@
package org.apache.fineract.portfolio.loanaccount.service;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Random;
import java.util.concurrent.Callable;
import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
import org.apache.fineract.infrastructure.jobs.exception.JobExecutionException;
@@ -38,7 +38,7 @@ import org.springframework.stereotype.Component;
public class RecalculateInterestPoster implements Callable<Void> {
private static final Logger LOG = LoggerFactory.getLogger(RecalculateInterestPoster.class);
private static final Random random = new Random();
private static final SecureRandom random = new SecureRandom();
private Collection<Long> loanIds;
private LoanWritePlatformService loanWritePlatformService;
@@ -81,7 +81,6 @@ public class RecalculateInterestPoster implements Callable<Void> {
// Else sleep for a random time (between 1 to 10
// seconds) and continue
try {
Random random = new Random();
int randomNum = random.nextInt(maxIntervalBetweenRetries + 1);
Thread.sleep(1000 + (randomNum * 1000));
numberOfRetries = numberOfRetries + 1;
fineract-provider/src/main/java/org/apache/fineract/portfolio/self/registration/service/SelfServiceRegistrationWritePlatformServiceImpl.java
+3 -1
View File
@@ -22,6 +22,7 @@ import com.google.gson.Gson;
import com.google.gson.JsonElement;
import com.google.gson.reflect.TypeToken;
import java.lang.reflect.Type;
import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
@@ -86,6 +87,7 @@ public class SelfServiceRegistrationWritePlatformServiceImpl implements SelfServ
private final SmsCampaignDropdownReadPlatformService smsCampaignDropdownReadPlatformService;
private final AppUserReadPlatformService appUserReadPlatformService;
private final RoleRepository roleRepository;
private static final SecureRandom secureRandom = new SecureRandom();
@Autowired
public SelfServiceRegistrationWritePlatformServiceImpl(final SelfServiceRegistrationRepository selfServiceRegistrationRepository,
@@ -234,7 +236,7 @@ public class SelfServiceRegistrationWritePlatformServiceImpl implements SelfServ
}
public static String randomAuthorizationTokenGeneration() {
Integer randomPIN = (int) (Math.random() * 9000) + 1000;
Integer randomPIN = (int) (secureRandom.nextDouble() * 9000) + 1000;
return randomPIN.toString();
}