1 |
|
|
2 |
|
|
3 |
|
|
4 |
|
|
5 |
|
|
6 |
|
|
7 |
|
|
8 |
|
|
9 |
|
|
10 |
|
|
11 |
|
|
12 |
|
|
13 |
|
|
14 |
|
|
15 |
|
|
16 |
|
|
17 |
|
|
18 |
|
|
19 |
|
|
20 |
|
package com.xpn.xwiki.user.impl.xwiki; |
21 |
|
|
22 |
|
import java.security.MessageDigest; |
23 |
|
import java.text.DateFormat; |
24 |
|
import java.text.SimpleDateFormat; |
25 |
|
import java.util.Date; |
26 |
|
import java.util.Locale; |
27 |
|
import java.util.TimeZone; |
28 |
|
|
29 |
|
import javax.crypto.Cipher; |
30 |
|
import javax.servlet.http.Cookie; |
31 |
|
import javax.servlet.http.HttpServletRequest; |
32 |
|
import javax.servlet.http.HttpServletResponse; |
33 |
|
|
34 |
|
import org.apache.commons.codec.binary.Base64; |
35 |
|
import org.apache.commons.lang3.StringUtils; |
36 |
|
import org.securityfilter.authenticator.persistent.DefaultPersistentLoginManager; |
37 |
|
import org.securityfilter.filter.SecurityRequestWrapper; |
38 |
|
import org.slf4j.Logger; |
39 |
|
import org.slf4j.LoggerFactory; |
40 |
|
|
41 |
|
|
42 |
|
|
43 |
|
|
44 |
|
|
45 |
|
|
46 |
|
|
47 |
|
|
48 |
|
|
49 |
|
|
50 |
|
|
51 |
|
|
52 |
|
|
53 |
|
|
54 |
|
|
55 |
|
|
56 |
|
|
57 |
|
|
58 |
|
@version |
59 |
|
|
|
|
| 55.8% |
Uncovered Elements: 140 (317) |
Complexity: 84 |
Complexity Density: 0.42 |
|
60 |
|
public class MyPersistentLoginManager extends DefaultPersistentLoginManager |
61 |
|
{ |
62 |
|
private static final long serialVersionUID = -8454351828032103173L; |
63 |
|
|
64 |
|
|
65 |
|
|
66 |
|
|
67 |
|
private static final String FIELD_SEPARATOR = ":"; |
68 |
|
|
69 |
|
|
70 |
|
|
71 |
|
|
72 |
|
private static final String COOKIE_DOT_PFX = "."; |
73 |
|
|
74 |
|
|
75 |
|
|
76 |
|
|
77 |
|
private static final Logger LOGGER = LoggerFactory.getLogger(MyPersistentLoginManager.class); |
78 |
|
|
79 |
|
|
80 |
|
|
81 |
|
|
82 |
|
private static final String DEFAULT_VALUE = "false"; |
83 |
|
|
84 |
|
|
85 |
|
private static final DateFormat COOKIE_EXPIRE_FORMAT = new SimpleDateFormat("EEE, dd-MMM-yyyy HH:mm:ss z", |
86 |
|
Locale.US); |
|
|
| 100% |
Uncovered Elements: 0 (1) |
Complexity: 1 |
Complexity Density: 1 |
|
87 |
32 |
static {... |
88 |
32 |
COOKIE_EXPIRE_FORMAT.setTimeZone(TimeZone.getTimeZone("GMT")); |
89 |
|
} |
90 |
|
|
91 |
|
|
92 |
|
private static final String COOKIE_EXPIRE_NOW = COOKIE_EXPIRE_FORMAT.format(new Date(0)); |
93 |
|
|
94 |
|
|
95 |
|
|
96 |
|
|
97 |
|
|
98 |
|
|
99 |
|
|
100 |
|
|
101 |
|
protected String[] cookieDomains; |
102 |
|
|
103 |
|
|
104 |
|
|
105 |
|
|
106 |
|
|
107 |
|
protected String cookiePath = "/"; |
108 |
|
|
109 |
|
|
110 |
|
|
111 |
|
|
112 |
|
protected String cookiePrefix = ""; |
113 |
|
|
114 |
|
|
115 |
|
|
116 |
|
@link |
117 |
|
|
118 |
|
|
|
|
| 100% |
Uncovered Elements: 0 (1) |
Complexity: 1 |
Complexity Density: 1 |
|
119 |
36 |
public MyPersistentLoginManager()... |
120 |
|
{ |
121 |
36 |
super(); |
122 |
|
} |
123 |
|
|
124 |
|
|
125 |
|
|
126 |
|
|
127 |
|
@param |
128 |
|
@return |
129 |
|
|
|
|
| 0% |
Uncovered Elements: 5 (5) |
Complexity: 3 |
Complexity Density: 1 |
|
130 |
0 |
private String conformCookieDomain(String domain)... |
131 |
|
{ |
132 |
0 |
if (domain != null && !domain.startsWith(COOKIE_DOT_PFX)) { |
133 |
0 |
return COOKIE_DOT_PFX.concat(domain); |
134 |
|
} else { |
135 |
0 |
return domain; |
136 |
|
} |
137 |
|
} |
138 |
|
|
139 |
|
|
140 |
|
@link |
141 |
|
|
142 |
|
@param@link |
143 |
|
|
144 |
|
@see |
145 |
|
|
|
|
| 33.3% |
Uncovered Elements: 6 (9) |
Complexity: 4 |
Complexity Density: 0.8 |
|
146 |
36 |
public void setCookieDomains(String[] cdlist)... |
147 |
|
{ |
148 |
36 |
if (cdlist != null && cdlist.length > 0) { |
149 |
0 |
this.cookieDomains = new String[cdlist.length]; |
150 |
0 |
for (int i = 0; i < cdlist.length; ++i) { |
151 |
0 |
this.cookieDomains[i] = conformCookieDomain(cdlist[i]); |
152 |
|
} |
153 |
|
} else { |
154 |
36 |
this.cookieDomains = null; |
155 |
|
} |
156 |
|
} |
157 |
|
|
158 |
|
|
159 |
|
@link |
160 |
|
|
161 |
|
@param@link |
162 |
|
@see |
163 |
|
|
|
|
| 0% |
Uncovered Elements: 1 (1) |
Complexity: 1 |
Complexity Density: 1 |
|
164 |
0 |
public void setCookiePath(String cp)... |
165 |
|
{ |
166 |
0 |
this.cookiePath = cp; |
167 |
|
} |
168 |
|
|
169 |
|
|
170 |
|
|
171 |
|
|
172 |
|
@param |
173 |
|
@param |
174 |
|
@param |
175 |
|
@param |
176 |
|
@deprecated |
177 |
|
@link |
178 |
|
|
|
|
| 0% |
Uncovered Elements: 1 (1) |
Complexity: 1 |
Complexity Density: 1 |
|
179 |
0 |
@Deprecated... |
180 |
|
public void setupCookie(Cookie cookie, boolean sessionCookie, String cookieDomain, HttpServletResponse response) |
181 |
|
{ |
182 |
0 |
setupCookie(cookie, sessionCookie, false, cookieDomain, response); |
183 |
|
} |
184 |
|
|
185 |
|
|
186 |
|
|
187 |
|
|
188 |
|
@param |
189 |
|
@param |
190 |
|
@param |
191 |
|
@param |
192 |
|
@param |
193 |
|
|
|
|
| 63.6% |
Uncovered Elements: 4 (11) |
Complexity: 3 |
Complexity Density: 0.43 |
|
194 |
240 |
private void setupCookie(Cookie cookie, boolean sessionCookie, boolean secureCookie, String cookieDomain,... |
195 |
|
HttpServletResponse response) |
196 |
|
{ |
197 |
240 |
if (!sessionCookie) { |
198 |
0 |
setMaxAge(cookie); |
199 |
|
} |
200 |
240 |
cookie.setSecure(secureCookie); |
201 |
240 |
cookie.setPath(this.cookiePath); |
202 |
240 |
if (cookieDomain != null) { |
203 |
0 |
cookie.setDomain(cookieDomain); |
204 |
|
} |
205 |
240 |
addCookie(response, cookie); |
206 |
|
} |
207 |
|
|
208 |
|
|
209 |
|
|
210 |
|
|
211 |
|
@param |
212 |
|
@param |
213 |
|
@param |
214 |
|
@param |
215 |
|
|
|
|
| 62.5% |
Uncovered Elements: 15 (40) |
Complexity: 9 |
Complexity Density: 0.3 |
|
216 |
60 |
@Override... |
217 |
|
public void rememberLogin(HttpServletRequest request, HttpServletResponse response, String username, String password) |
218 |
|
{ |
219 |
60 |
String protectedUsername = username; |
220 |
60 |
String protectedPassword = password; |
221 |
60 |
if (this.protection.equals(PROTECTION_ALL) || this.protection.equals(PROTECTION_ENCRYPTION)) { |
222 |
60 |
protectedUsername = encryptText(protectedUsername); |
223 |
60 |
protectedPassword = encryptText(protectedPassword); |
224 |
60 |
if (protectedUsername == null || protectedPassword == null) { |
225 |
0 |
LOGGER.error("ERROR!!"); |
226 |
0 |
LOGGER.error("There was a problem encrypting the username or password!!"); |
227 |
0 |
LOGGER.error("Remember Me function will be disabled!!"); |
228 |
0 |
return; |
229 |
|
} |
230 |
|
} |
231 |
|
|
232 |
|
|
233 |
60 |
boolean sessionCookie = !(isTrue(request.getParameter("j_rememberme"))); |
234 |
60 |
boolean secureCookie = request.isSecure(); |
235 |
60 |
String cookieDomain = getCookieDomain(request); |
236 |
|
|
237 |
|
|
238 |
|
|
239 |
|
|
240 |
60 |
Cookie usernameCookie = new Cookie(getCookiePrefix() + COOKIE_USERNAME, protectedUsername); |
241 |
60 |
setupCookie(usernameCookie, sessionCookie, secureCookie, cookieDomain, response); |
242 |
|
|
243 |
|
|
244 |
60 |
Cookie passwdCookie = new Cookie(getCookiePrefix() + COOKIE_PASSWORD, protectedPassword); |
245 |
60 |
setupCookie(passwdCookie, sessionCookie, secureCookie, cookieDomain, response); |
246 |
|
|
247 |
|
|
248 |
60 |
Cookie rememberCookie = new Cookie(getCookiePrefix() + COOKIE_REMEMBERME, !sessionCookie + ""); |
249 |
60 |
setupCookie(rememberCookie, sessionCookie, secureCookie, cookieDomain, response); |
250 |
|
|
251 |
60 |
if (this.protection.equals(PROTECTION_ALL) || this.protection.equals(PROTECTION_VALIDATION)) { |
252 |
60 |
String validationHash = getValidationHash(protectedUsername, protectedPassword, getClientIP(request)); |
253 |
60 |
if (validationHash != null) { |
254 |
|
|
255 |
60 |
Cookie validationCookie = new Cookie(getCookiePrefix() + COOKIE_VALIDATION, validationHash); |
256 |
60 |
setupCookie(validationCookie, sessionCookie, secureCookie, cookieDomain, response); |
257 |
|
} else { |
258 |
0 |
if (LOGGER.isErrorEnabled()) { |
259 |
0 |
LOGGER.error("WARNING!!! WARNING!!!"); |
260 |
0 |
LOGGER.error("PROTECTION=ALL or PROTECTION=VALIDATION was specified"); |
261 |
0 |
LOGGER.error("but Validation Hash could NOT be generated"); |
262 |
0 |
LOGGER.error("Validation has been disabled!!!!"); |
263 |
|
} |
264 |
|
} |
265 |
|
} |
266 |
60 |
return; |
267 |
|
} |
268 |
|
|
269 |
|
|
270 |
|
|
271 |
|
|
272 |
|
|
273 |
|
@param |
274 |
|
|
|
|
| 0% |
Uncovered Elements: 6 (6) |
Complexity: 3 |
Complexity Density: 0.75 |
|
275 |
0 |
private void setMaxAge(Cookie cookie)... |
276 |
|
{ |
277 |
0 |
try { |
278 |
0 |
cookie.setMaxAge(Math.round(60 * 60 * 24 * Float.parseFloat(this.cookieLife))); |
279 |
|
} catch (Exception e) { |
280 |
0 |
if (LOGGER.isErrorEnabled()) { |
281 |
0 |
LOGGER.error("Failed setting cookie Max age with duration " + this.cookieLife); |
282 |
|
} |
283 |
|
} |
284 |
|
} |
285 |
|
|
286 |
|
|
287 |
|
|
288 |
|
|
289 |
|
@param |
290 |
|
@param |
291 |
|
|
|
|
| 74.3% |
Uncovered Elements: 9 (35) |
Complexity: 8 |
Complexity Density: 0.38 |
|
292 |
244 |
private void addCookie(HttpServletResponse response, Cookie cookie)... |
293 |
|
{ |
294 |
244 |
if (LOGGER.isDebugEnabled()) { |
295 |
0 |
LOGGER.debug("Adding cookie: " + cookie.getDomain() + cookie.getPath() + " " + cookie.getName() + "=" |
296 |
|
+ cookie.getValue()); |
297 |
|
} |
298 |
|
|
299 |
|
|
300 |
|
|
301 |
244 |
StringBuilder cookieValue = new StringBuilder(150); |
302 |
244 |
cookieValue.append(cookie.getName() + "="); |
303 |
244 |
if (StringUtils.isNotEmpty(cookie.getValue())) { |
304 |
240 |
cookieValue.append("\"" + cookie.getValue() + "\""); |
305 |
|
} |
306 |
244 |
cookieValue.append("; Version=1"); |
307 |
244 |
if (cookie.getMaxAge() >= 0) { |
308 |
4 |
cookieValue.append("; Max-Age=" + cookie.getMaxAge()); |
309 |
|
|
310 |
4 |
cookieValue.append("; Expires="); |
311 |
4 |
if (cookie.getMaxAge() == 0) { |
312 |
4 |
cookieValue.append(COOKIE_EXPIRE_NOW); |
313 |
|
} else { |
314 |
0 |
cookieValue.append(COOKIE_EXPIRE_FORMAT.format(new Date(System.currentTimeMillis() + cookie.getMaxAge() |
315 |
|
* 1000L))); |
316 |
|
} |
317 |
|
} |
318 |
244 |
if (StringUtils.isNotEmpty(cookie.getDomain())) { |
319 |
|
|
320 |
0 |
cookieValue.append("; Domain=" + cookie.getDomain().toLowerCase()); |
321 |
|
} |
322 |
244 |
if (StringUtils.isNotEmpty(cookie.getPath())) { |
323 |
244 |
cookieValue.append("; Path=" + cookie.getPath()); |
324 |
|
} |
325 |
|
|
326 |
244 |
cookieValue.append("; HttpOnly"); |
327 |
|
|
328 |
244 |
if (cookie.getSecure()) { |
329 |
0 |
cookieValue.append("; Secure"); |
330 |
|
} |
331 |
|
|
332 |
|
|
333 |
|
|
334 |
|
|
335 |
|
|
336 |
|
|
337 |
|
|
338 |
|
|
339 |
|
|
340 |
244 |
response.addHeader("Set-Cookie", cookieValue.toString()); |
341 |
|
} |
342 |
|
|
343 |
|
|
344 |
|
|
345 |
|
|
346 |
|
|
347 |
|
|
348 |
|
@param |
349 |
|
@return |
350 |
|
|
|
|
| 37.5% |
Uncovered Elements: 10 (16) |
Complexity: 4 |
Complexity Density: 0.4 |
|
351 |
64 |
private String getCookieDomain(HttpServletRequest request)... |
352 |
|
{ |
353 |
64 |
String cookieDomain = null; |
354 |
64 |
if (this.cookieDomains != null) { |
355 |
|
|
356 |
|
|
357 |
|
|
358 |
0 |
String servername = conformCookieDomain(request.getServerName()); |
359 |
0 |
for (String domain : this.cookieDomains) { |
360 |
0 |
if (servername.endsWith(domain)) { |
361 |
0 |
cookieDomain = domain; |
362 |
0 |
break; |
363 |
|
} |
364 |
|
} |
365 |
|
} |
366 |
64 |
if (LOGGER.isDebugEnabled()) { |
367 |
0 |
LOGGER.debug("Cookie domain is:" + cookieDomain); |
368 |
|
} |
369 |
64 |
return cookieDomain; |
370 |
|
} |
371 |
|
|
372 |
|
|
373 |
|
|
374 |
|
|
375 |
|
|
376 |
|
|
377 |
|
@param |
378 |
|
@param |
379 |
|
@param |
380 |
|
@return |
381 |
|
|
|
|
| 75.7% |
Uncovered Elements: 9 (37) |
Complexity: 6 |
Complexity Density: 0.21 |
|
382 |
60 |
private String getValidationHash(String username, String password, String clientIP)... |
383 |
|
{ |
384 |
60 |
if (this.validationKey == null) { |
385 |
0 |
if (LOGGER.isErrorEnabled()) { |
386 |
0 |
LOGGER.error("ERROR! >> validationKey not specified..."); |
387 |
0 |
LOGGER.error("you are REQUIRED to specify the validatonkey in xwiki.cfg"); |
388 |
|
} |
389 |
0 |
return null; |
390 |
|
} |
391 |
60 |
MessageDigest md5 = null; |
392 |
60 |
StringBuffer sbValueBeforeMD5 = new StringBuffer(); |
393 |
|
|
394 |
60 |
try { |
395 |
60 |
md5 = MessageDigest.getInstance("MD5"); |
396 |
|
|
397 |
60 |
sbValueBeforeMD5.append(username); |
398 |
60 |
sbValueBeforeMD5.append(FIELD_SEPARATOR); |
399 |
60 |
sbValueBeforeMD5.append(password.toString()); |
400 |
60 |
sbValueBeforeMD5.append(FIELD_SEPARATOR); |
401 |
60 |
if (isTrue(this.useIP)) { |
402 |
60 |
sbValueBeforeMD5.append(clientIP.toString()); |
403 |
60 |
sbValueBeforeMD5.append(FIELD_SEPARATOR); |
404 |
|
} |
405 |
60 |
sbValueBeforeMD5.append(this.validationKey.toString()); |
406 |
|
|
407 |
60 |
this.valueBeforeMD5 = sbValueBeforeMD5.toString(); |
408 |
60 |
md5.update(this.valueBeforeMD5.getBytes()); |
409 |
|
|
410 |
60 |
byte[] array = md5.digest(); |
411 |
60 |
StringBuffer sb = new StringBuffer(); |
412 |
60 |
for (byte element : array) { |
413 |
960 |
int b = element & 0xFF; |
414 |
960 |
if (b < 0x10) { |
415 |
23 |
sb.append('0'); |
416 |
|
} |
417 |
960 |
sb.append(Integer.toHexString(b)); |
418 |
|
} |
419 |
60 |
this.valueAfterMD5 = sb.toString(); |
420 |
|
} catch (Exception e) { |
421 |
0 |
LOGGER.error("Failed to get [" + MessageDigest.class.getName() + "] instance", e); |
422 |
|
} |
423 |
|
|
424 |
60 |
return this.valueAfterMD5; |
425 |
|
} |
426 |
|
|
427 |
|
|
428 |
|
|
429 |
|
|
430 |
|
|
431 |
|
@param |
432 |
|
@return |
433 |
|
|
434 |
|
|
|
|
| 47.6% |
Uncovered Elements: 11 (21) |
Complexity: 5 |
Complexity Density: 0.33 |
|
435 |
120 |
public String encryptText(String clearText)... |
436 |
|
{ |
437 |
120 |
try { |
438 |
120 |
Cipher c1 = Cipher.getInstance(this.cipherParameters); |
439 |
120 |
if (this.secretKey != null) { |
440 |
120 |
c1.init(Cipher.ENCRYPT_MODE, this.secretKey); |
441 |
120 |
byte[] clearTextBytes; |
442 |
120 |
clearTextBytes = clearText.getBytes(); |
443 |
120 |
byte[] encryptedText = c1.doFinal(clearTextBytes); |
444 |
120 |
String encryptedEncodedText = new String(Base64.encodeBase64(encryptedText)); |
445 |
|
|
446 |
|
|
447 |
|
|
448 |
|
|
449 |
120 |
return encryptedEncodedText.replaceAll("=", "_"); |
450 |
|
} |
451 |
0 |
if (LOGGER.isErrorEnabled()) { |
452 |
0 |
LOGGER.error("ERROR! >> SecretKey not generated..."); |
453 |
0 |
LOGGER.error("you are REQUIRED to specify the encryptionKey in xwiki.cfg"); |
454 |
|
} |
455 |
|
} catch (Exception e) { |
456 |
0 |
if (LOGGER.isErrorEnabled()) { |
457 |
0 |
LOGGER.error("Failed to encrypt text: " + clearText, e); |
458 |
|
} |
459 |
|
} |
460 |
0 |
return null; |
461 |
|
} |
462 |
|
|
463 |
|
|
464 |
|
|
465 |
|
|
466 |
|
@param |
467 |
|
@param |
468 |
|
|
|
|
| 100% |
Uncovered Elements: 0 (6) |
Complexity: 1 |
Complexity Density: 0.17 |
|
469 |
1 |
@Override... |
470 |
|
public void forgetLogin(HttpServletRequest request, HttpServletResponse response) |
471 |
|
{ |
472 |
1 |
((SecurityRequestWrapper) request).setUserPrincipal(null); |
473 |
1 |
removeCookie(request, response, getCookiePrefix() + COOKIE_USERNAME); |
474 |
1 |
removeCookie(request, response, getCookiePrefix() + COOKIE_PASSWORD); |
475 |
1 |
removeCookie(request, response, getCookiePrefix() + COOKIE_REMEMBERME); |
476 |
1 |
removeCookie(request, response, getCookiePrefix() + COOKIE_VALIDATION); |
477 |
1 |
return; |
478 |
|
} |
479 |
|
|
480 |
|
|
481 |
|
|
482 |
|
|
483 |
|
|
484 |
|
@param |
485 |
|
@param |
486 |
|
@return |
487 |
|
|
|
|
| 77.8% |
Uncovered Elements: 2 (9) |
Complexity: 3 |
Complexity Density: 0.6 |
|
488 |
4 |
private static Cookie getCookie(Cookie[] cookies, String cookieName)... |
489 |
|
{ |
490 |
4 |
if (cookies != null) { |
491 |
4 |
for (Cookie cookie : cookies) { |
492 |
14 |
if (cookieName.equals(cookie.getName())) { |
493 |
4 |
return (cookie); |
494 |
|
} |
495 |
|
} |
496 |
|
} |
497 |
0 |
return null; |
498 |
|
} |
499 |
|
|
500 |
|
|
501 |
|
|
502 |
|
|
503 |
|
@param |
504 |
|
@param |
505 |
|
@param |
506 |
|
|
|
|
| 71.4% |
Uncovered Elements: 4 (14) |
Complexity: 3 |
Complexity Density: 0.3 |
|
507 |
4 |
private void removeCookie(HttpServletRequest request, HttpServletResponse response, String cookieName)... |
508 |
|
{ |
509 |
4 |
Cookie cookie = getCookie(request.getCookies(), cookieName); |
510 |
4 |
if (cookie != null) { |
511 |
4 |
cookie.setMaxAge(0); |
512 |
4 |
cookie.setValue(""); |
513 |
4 |
cookie.setPath(this.cookiePath); |
514 |
4 |
addCookie(response, cookie); |
515 |
4 |
String cookieDomain = getCookieDomain(request); |
516 |
4 |
if (cookieDomain != null) { |
517 |
0 |
cookie.setDomain(cookieDomain); |
518 |
0 |
addCookie(response, cookie); |
519 |
|
} |
520 |
|
} |
521 |
|
} |
522 |
|
|
523 |
|
|
524 |
|
|
525 |
|
|
526 |
|
@param |
527 |
|
@return |
528 |
|
|
|
|
| 100% |
Uncovered Elements: 0 (1) |
Complexity: 1 |
Complexity Density: 1 |
|
529 |
120 |
private static boolean isTrue(String text)... |
530 |
|
{ |
531 |
120 |
return "true".equals(text) || "1".equals(text) || "yes".equals(text); |
532 |
|
} |
533 |
|
|
534 |
|
|
535 |
|
|
536 |
|
|
537 |
|
|
538 |
|
@param |
539 |
|
@param |
540 |
|
@param |
541 |
|
@return |
542 |
|
|
|
|
| 100% |
Uncovered Elements: 0 (10) |
Complexity: 3 |
Complexity Density: 0.5 |
|
543 |
4847 |
private static String getCookieValue(Cookie[] cookies, String cookieName, String defaultValue)... |
544 |
|
{ |
545 |
4848 |
String value = defaultValue; |
546 |
4848 |
if (cookies != null) { |
547 |
896 |
for (Cookie cookie : cookies) { |
548 |
900 |
if (cookieName.equals(cookie.getName())) { |
549 |
1 |
value = cookie.getValue(); |
550 |
|
} |
551 |
|
} |
552 |
|
} |
553 |
4849 |
return value; |
554 |
|
} |
555 |
|
|
556 |
|
|
557 |
|
|
558 |
|
|
559 |
|
@param |
560 |
|
@param |
561 |
|
@return |
562 |
|
|
563 |
|
|
|
|
| 0% |
Uncovered Elements: 15 (15) |
Complexity: 4 |
Complexity Density: 0.36 |
|
564 |
0 |
private boolean checkValidation(HttpServletRequest request, HttpServletResponse response)... |
565 |
|
{ |
566 |
0 |
if (this.protection.equals(PROTECTION_ALL) || this.protection.equals(PROTECTION_VALIDATION)) { |
567 |
0 |
String username = getCookieValue(request.getCookies(), getCookiePrefix() + COOKIE_USERNAME, DEFAULT_VALUE); |
568 |
0 |
String password = getCookieValue(request.getCookies(), getCookiePrefix() + COOKIE_PASSWORD, DEFAULT_VALUE); |
569 |
0 |
String cookieHash = |
570 |
|
getCookieValue(request.getCookies(), getCookiePrefix() + COOKIE_VALIDATION, DEFAULT_VALUE); |
571 |
0 |
String calculatedHash = getValidationHash(username, password, getClientIP(request)); |
572 |
0 |
if (cookieHash.equals(calculatedHash)) { |
573 |
0 |
return true; |
574 |
|
} else { |
575 |
0 |
LOGGER.warn("Login cookie validation hash mismatch! Cookies have been tampered with"); |
576 |
0 |
LOGGER.info("Login cookie is being deleted!"); |
577 |
0 |
forgetLogin(request, response); |
578 |
|
} |
579 |
|
} |
580 |
0 |
return false; |
581 |
|
} |
582 |
|
|
583 |
|
|
584 |
|
|
585 |
|
|
586 |
|
@param |
587 |
|
@param |
588 |
|
@return |
589 |
|
|
|
|
| 30.8% |
Uncovered Elements: 9 (13) |
Complexity: 5 |
Complexity Density: 0.71 |
|
590 |
2424 |
@Override... |
591 |
|
|
592 |
|
public String getRememberedUsername(HttpServletRequest request, HttpServletResponse response) |
593 |
|
{ |
594 |
2424 |
String username = getCookieValue(request.getCookies(), getCookiePrefix() + COOKIE_USERNAME, DEFAULT_VALUE); |
595 |
|
|
596 |
2423 |
if (!username.equals(DEFAULT_VALUE)) { |
597 |
0 |
if (checkValidation(request, response)) { |
598 |
0 |
if (this.protection.equals(PROTECTION_ALL) || this.protection.equals(PROTECTION_ENCRYPTION)) { |
599 |
0 |
username = decryptText(username); |
600 |
|
} |
601 |
0 |
return username; |
602 |
|
} |
603 |
|
} |
604 |
2424 |
return null; |
605 |
|
} |
606 |
|
|
607 |
|
|
608 |
|
|
609 |
|
|
610 |
|
@param |
611 |
|
@param |
612 |
|
@return |
613 |
|
|
|
|
| 30.8% |
Uncovered Elements: 9 (13) |
Complexity: 5 |
Complexity Density: 0.71 |
|
614 |
2422 |
@Override... |
615 |
|
|
616 |
|
public String getRememberedPassword(HttpServletRequest request, HttpServletResponse response) |
617 |
|
{ |
618 |
2423 |
String password = getCookieValue(request.getCookies(), getCookiePrefix() + COOKIE_PASSWORD, DEFAULT_VALUE); |
619 |
2422 |
if (!password.equals(DEFAULT_VALUE)) { |
620 |
0 |
if (checkValidation(request, response)) { |
621 |
0 |
if (this.protection.equals(PROTECTION_ALL) || this.protection.equals(PROTECTION_ENCRYPTION)) { |
622 |
0 |
password = decryptText(password); |
623 |
|
} |
624 |
0 |
return password; |
625 |
|
} |
626 |
|
} |
627 |
2422 |
return null; |
628 |
|
} |
629 |
|
|
|
|
| 60% |
Uncovered Elements: 2 (5) |
Complexity: 2 |
Complexity Density: 0.67 |
|
630 |
1 |
@Override... |
631 |
|
public boolean rememberingLogin(HttpServletRequest request) |
632 |
|
{ |
633 |
1 |
if (getCookieValue(request.getCookies(), getCookiePrefix() + COOKIE_REMEMBERME, "false").equals("true")) { |
634 |
0 |
return true; |
635 |
|
} else { |
636 |
1 |
return false; |
637 |
|
} |
638 |
|
} |
639 |
|
|
640 |
|
|
641 |
|
|
642 |
|
|
643 |
|
@param |
644 |
|
@return |
645 |
|
|
|
|
| 0% |
Uncovered Elements: 9 (9) |
Complexity: 2 |
Complexity Density: 0.22 |
|
646 |
0 |
private String decryptText(String encryptedText)... |
647 |
|
{ |
648 |
0 |
try { |
649 |
|
|
650 |
|
|
651 |
|
|
652 |
|
|
653 |
|
|
654 |
0 |
byte[] decodedEncryptedText = |
655 |
|
Base64.decodeBase64(encryptedText.replaceAll("_", "=").getBytes("ISO-8859-1")); |
656 |
0 |
Cipher c1 = Cipher.getInstance(this.cipherParameters); |
657 |
0 |
c1.init(Cipher.DECRYPT_MODE, this.secretKey); |
658 |
0 |
byte[] decryptedText = c1.doFinal(decodedEncryptedText); |
659 |
0 |
String decryptedTextString = new String(decryptedText); |
660 |
0 |
return decryptedTextString; |
661 |
|
} catch (Exception e) { |
662 |
0 |
LOGGER.error("Error decypting text: " + encryptedText, e); |
663 |
0 |
return null; |
664 |
|
} |
665 |
|
} |
666 |
|
|
667 |
|
|
668 |
|
|
669 |
|
|
670 |
|
|
671 |
|
|
672 |
|
@param |
673 |
|
@return |
674 |
|
|
|
|
| 50% |
Uncovered Elements: 5 (10) |
Complexity: 4 |
Complexity Density: 0.67 |
|
675 |
60 |
protected String getClientIP(HttpServletRequest request)... |
676 |
|
{ |
677 |
60 |
String remoteIP = request.getHeader("X-Forwarded-For"); |
678 |
60 |
if (remoteIP == null || "".equals(remoteIP)) { |
679 |
60 |
remoteIP = request.getRemoteAddr(); |
680 |
0 |
} else if (remoteIP.indexOf(',') != -1) { |
681 |
0 |
remoteIP = remoteIP.substring(0, remoteIP.indexOf(',')); |
682 |
|
} |
683 |
60 |
return remoteIP; |
684 |
|
} |
685 |
|
|
686 |
|
|
687 |
|
@link |
688 |
|
|
689 |
|
@param@link |
690 |
|
@see |
691 |
|
|
|
|
| 0% |
Uncovered Elements: 1 (1) |
Complexity: 1 |
Complexity Density: 1 |
|
692 |
0 |
public void setCookiePrefix(String prefix)... |
693 |
|
{ |
694 |
0 |
this.cookiePrefix = prefix; |
695 |
|
} |
696 |
|
|
697 |
|
|
698 |
|
@link |
699 |
|
|
700 |
|
@return@link |
701 |
|
@see |
702 |
|
|
|
|
| 100% |
Uncovered Elements: 0 (1) |
Complexity: 1 |
Complexity Density: 1 |
|
703 |
5091 |
public String getCookiePrefix()... |
704 |
|
{ |
705 |
5092 |
return this.cookiePrefix; |
706 |
|
} |
707 |
|
} |