This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-plugins.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 04ba60ae1 Improved: Generate a longer password for the users created
by the LinkedIn and GitHub login of the passport plugin (OFBIZ-13658)
04ba60ae1 is described below
commit 04ba60ae17ef0f18370a5fb7d4318ee67c792b4d
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Oct 7 23:41:26 2026 +0530
Improved: Generate a longer password for the users created by the LinkedIn
and GitHub login of the passport plugin (OFBIZ-13658)
GitHubEvents and LinkedInEvents set a generated password on the user login
created for an external account, and the password had only as many characters
as password.length.min (5 by default), which is much weaker than needed for a
credential that stays valid on the account after the login.
The password is now generated with StringUtil.randomString and a fixed
length of 16 characters, independent of password.length.min. The now unused
RandomStringUtils and EntityUtilProperties imports and the private ALPHANUMERIC
constant are removed.
---
.../main/java/org/apache/ofbiz/passport/event/GitHubEvents.java | 9 +++------
.../java/org/apache/ofbiz/passport/event/LinkedInEvents.java | 9 +++------
2 files changed, 6 insertions(+), 12 deletions(-)
diff --git
a/passport/src/main/java/org/apache/ofbiz/passport/event/GitHubEvents.java
b/passport/src/main/java/org/apache/ofbiz/passport/event/GitHubEvents.java
index 05fe18041..be7aad237 100644
--- a/passport/src/main/java/org/apache/ofbiz/passport/event/GitHubEvents.java
+++ b/passport/src/main/java/org/apache/ofbiz/passport/event/GitHubEvents.java
@@ -30,7 +30,6 @@ import java.util.Map;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.apache.commons.lang.RandomStringUtils;
import org.apache.http.HttpStatus;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
@@ -44,6 +43,7 @@ import
org.apache.ofbiz.base.conversion.JSONConverters.JSONToMap;
import org.apache.ofbiz.base.crypto.HashCrypt;
import org.apache.ofbiz.base.lang.JSON;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.StringUtil;
import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.UtilMisc;
import org.apache.ofbiz.base.util.UtilProperties;
@@ -54,7 +54,6 @@ import org.apache.ofbiz.entity.Delegator;
import org.apache.ofbiz.entity.GenericEntityException;
import org.apache.ofbiz.entity.GenericValue;
import org.apache.ofbiz.entity.util.EntityQuery;
-import org.apache.ofbiz.entity.util.EntityUtilProperties;
import org.apache.ofbiz.passport.user.GitHubAuthenticator;
import org.apache.ofbiz.passport.util.PassportUtil;
import org.apache.ofbiz.product.store.ProductStoreWorker;
@@ -77,7 +76,7 @@ public class GitHubEvents {
private static final String SESSION_GITHUB_STATE = "_GITHUB_STATE_";
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
- private static final String ALPHANUMERIC =
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+ private static final int AUTO_PASSWORD_LENGTH = 16;
public static final String ENV_PREFIX =
UtilProperties.getPropertyValue(GitHubAuthenticator.PROPS, "github.env.prefix",
"test");
@@ -276,9 +275,7 @@ public class GitHubEvents {
String userLoginId = authn.createUser(userInfo);
userLogin =
EntityQuery.use(delegator).from("UserLogin").where("userLoginId",
userLoginId).queryOne();
}
- String autoPassword = RandomStringUtils.random(
- EntityUtilProperties.getPropertyAsInteger("security",
"password.length.min", 5), 0, 0, true, true,
- ALPHANUMERIC.toCharArray(), SECURE_RANDOM);
+ String autoPassword =
StringUtil.randomString(AUTO_PASSWORD_LENGTH, StringUtil.ALPHANUMERIC_CHARS);
boolean useEncryption =
"true".equals(UtilProperties.getPropertyValue("security", "password.encrypt"));
userLogin.set("currentPassword", useEncryption ?
HashCrypt.digestHash(LoginServices.getHashType(), null, autoPassword) :
autoPassword);
userLogin.store();
diff --git
a/passport/src/main/java/org/apache/ofbiz/passport/event/LinkedInEvents.java
b/passport/src/main/java/org/apache/ofbiz/passport/event/LinkedInEvents.java
index 2b49b7cb2..1e8613e54 100644
--- a/passport/src/main/java/org/apache/ofbiz/passport/event/LinkedInEvents.java
+++ b/passport/src/main/java/org/apache/ofbiz/passport/event/LinkedInEvents.java
@@ -31,7 +31,6 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.xml.parsers.ParserConfigurationException;
-import org.apache.commons.lang.RandomStringUtils;
import org.apache.http.HttpStatus;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
@@ -45,6 +44,7 @@ import
org.apache.ofbiz.base.conversion.JSONConverters.JSONToMap;
import org.apache.ofbiz.base.crypto.HashCrypt;
import org.apache.ofbiz.base.lang.JSON;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.StringUtil;
import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.UtilMisc;
import org.apache.ofbiz.base.util.UtilProperties;
@@ -55,7 +55,6 @@ import org.apache.ofbiz.entity.Delegator;
import org.apache.ofbiz.entity.GenericEntityException;
import org.apache.ofbiz.entity.GenericValue;
import org.apache.ofbiz.entity.util.EntityQuery;
-import org.apache.ofbiz.entity.util.EntityUtilProperties;
import org.apache.ofbiz.passport.user.LinkedInAuthenticator;
import org.apache.ofbiz.passport.util.PassportUtil;
import org.apache.ofbiz.product.store.ProductStoreWorker;
@@ -80,7 +79,7 @@ public class LinkedInEvents {
public static final String ENV_PREFIX =
UtilProperties.getPropertyValue(LinkedInAuthenticator.getPROPS(),
"linkedin.env.prefix", "test");
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
- private static final String ALPHANUMERIC =
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+ private static final int AUTO_PASSWORD_LENGTH = 16;
/**
* Redirect to LinkedIn login page.
@@ -267,9 +266,7 @@ public class LinkedInEvents {
String userLoginId = authn.createUser(userInfo);
userLogin =
EntityQuery.use(delegator).from("UserLogin").where("userLoginId",
userLoginId).queryOne();
}
- String autoPassword = RandomStringUtils.random(
- EntityUtilProperties.getPropertyAsInteger("security",
"password.length.min", 5), 0, 0, true, true,
- ALPHANUMERIC.toCharArray(), SECURE_RANDOM);
+ String autoPassword =
StringUtil.randomString(AUTO_PASSWORD_LENGTH, StringUtil.ALPHANUMERIC_CHARS);
boolean useEncryption =
"true".equals(UtilProperties.getPropertyValue("security", "password.encrypt"));
userLogin.set("currentPassword", useEncryption ?
HashCrypt.digestHash(LoginServices.getHashType(), null, autoPassword) :
autoPassword);
userLogin.store();
