This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-plugins.git
The following commit(s) were added to refs/heads/trunk by this push:
new 107a662b5 Improved: Generate a longer password for the users created
by the LinkedIn and GitHub login of the passport plugin (OFBIZ-13658)
107a662b5 is described below
commit 107a662b5bc41ac9e15ccd69969fc70daaccf913
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Oct 7 23:41:26 2026 +0530
Improved: Generate a longer password for the users created by the LinkedIn
and GitHub login of the passport plugin (OFBIZ-13658)
GitHubEvents and LinkedInEvents set a generated password on the user login
created for an external account, and the password had only as many characters
as password.length.min (5 by default), which is much weaker than needed for a
credential that stays valid on the account after the login.
The password is now generated with StringUtil.randomString and a fixed
length of 16 characters, independent of password.length.min. The now unused
RandomStringUtils and EntityUtilProperties imports and the private ALPHANUMERIC
constant are removed.
---
.../main/java/org/apache/ofbiz/passport/event/GitHubEvents.java | 9 +++------
.../java/org/apache/ofbiz/passport/event/LinkedInEvents.java | 9 +++------
2 files changed, 6 insertions(+), 12 deletions(-)
diff --git
a/passport/src/main/java/org/apache/ofbiz/passport/event/GitHubEvents.java
b/passport/src/main/java/org/apache/ofbiz/passport/event/GitHubEvents.java
index 36bed28bf..0ecafe35f 100644
--- a/passport/src/main/java/org/apache/ofbiz/passport/event/GitHubEvents.java
+++ b/passport/src/main/java/org/apache/ofbiz/passport/event/GitHubEvents.java
@@ -30,7 +30,6 @@ import java.util.Map;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
-import org.apache.commons.lang.RandomStringUtils;
import org.apache.http.HttpStatus;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
@@ -44,6 +43,7 @@ import
org.apache.ofbiz.base.conversion.JSONConverters.JSONToMap;
import org.apache.ofbiz.base.crypto.HashCrypt;
import org.apache.ofbiz.base.lang.JSON;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.StringUtil;
import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.UtilMisc;
import org.apache.ofbiz.base.util.UtilProperties;
@@ -54,7 +54,6 @@ import org.apache.ofbiz.entity.Delegator;
import org.apache.ofbiz.entity.GenericEntityException;
import org.apache.ofbiz.entity.GenericValue;
import org.apache.ofbiz.entity.util.EntityQuery;
-import org.apache.ofbiz.entity.util.EntityUtilProperties;
import org.apache.ofbiz.passport.user.GitHubAuthenticator;
import org.apache.ofbiz.passport.util.PassportUtil;
import org.apache.ofbiz.product.store.ProductStoreWorker;
@@ -77,7 +76,7 @@ public class GitHubEvents {
private static final String SESSION_GITHUB_STATE = "_GITHUB_STATE_";
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
- private static final String ALPHANUMERIC =
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+ private static final int AUTO_PASSWORD_LENGTH = 16;
public static final String ENV_PREFIX =
UtilProperties.getPropertyValue(GitHubAuthenticator.PROPS, "github.env.prefix",
"test");
@@ -276,9 +275,7 @@ public class GitHubEvents {
String userLoginId = authn.createUser(userInfo);
userLogin =
EntityQuery.use(delegator).from("UserLogin").where("userLoginId",
userLoginId).queryOne();
}
- String autoPassword = RandomStringUtils.random(
- EntityUtilProperties.getPropertyAsInteger("security",
"password.length.min", 5), 0, 0, true, true,
- ALPHANUMERIC.toCharArray(), SECURE_RANDOM);
+ String autoPassword =
StringUtil.randomString(AUTO_PASSWORD_LENGTH, StringUtil.ALPHANUMERIC_CHARS);
boolean useEncryption =
"true".equals(UtilProperties.getPropertyValue("security", "password.encrypt"));
userLogin.set("currentPassword", useEncryption ?
HashCrypt.digestHash(LoginServices.getHashType(), null, autoPassword) :
autoPassword);
userLogin.store();
diff --git
a/passport/src/main/java/org/apache/ofbiz/passport/event/LinkedInEvents.java
b/passport/src/main/java/org/apache/ofbiz/passport/event/LinkedInEvents.java
index bfe643929..deb84b7d7 100644
--- a/passport/src/main/java/org/apache/ofbiz/passport/event/LinkedInEvents.java
+++ b/passport/src/main/java/org/apache/ofbiz/passport/event/LinkedInEvents.java
@@ -31,7 +31,6 @@ import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import javax.xml.parsers.ParserConfigurationException;
-import org.apache.commons.lang.RandomStringUtils;
import org.apache.http.HttpStatus;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
@@ -45,6 +44,7 @@ import
org.apache.ofbiz.base.conversion.JSONConverters.JSONToMap;
import org.apache.ofbiz.base.crypto.HashCrypt;
import org.apache.ofbiz.base.lang.JSON;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.StringUtil;
import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.UtilMisc;
import org.apache.ofbiz.base.util.UtilProperties;
@@ -55,7 +55,6 @@ import org.apache.ofbiz.entity.Delegator;
import org.apache.ofbiz.entity.GenericEntityException;
import org.apache.ofbiz.entity.GenericValue;
import org.apache.ofbiz.entity.util.EntityQuery;
-import org.apache.ofbiz.entity.util.EntityUtilProperties;
import org.apache.ofbiz.passport.user.LinkedInAuthenticator;
import org.apache.ofbiz.passport.util.PassportUtil;
import org.apache.ofbiz.product.store.ProductStoreWorker;
@@ -80,7 +79,7 @@ public class LinkedInEvents {
public static final String ENV_PREFIX =
UtilProperties.getPropertyValue(LinkedInAuthenticator.getPROPS(),
"linkedin.env.prefix", "test");
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
- private static final String ALPHANUMERIC =
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+ private static final int AUTO_PASSWORD_LENGTH = 16;
/**
* Redirect to LinkedIn login page.
@@ -267,9 +266,7 @@ public class LinkedInEvents {
String userLoginId = authn.createUser(userInfo);
userLogin =
EntityQuery.use(delegator).from("UserLogin").where("userLoginId",
userLoginId).queryOne();
}
- String autoPassword = RandomStringUtils.random(
- EntityUtilProperties.getPropertyAsInteger("security",
"password.length.min", 5), 0, 0, true, true,
- ALPHANUMERIC.toCharArray(), SECURE_RANDOM);
+ String autoPassword =
StringUtil.randomString(AUTO_PASSWORD_LENGTH, StringUtil.ALPHANUMERIC_CHARS);
boolean useEncryption =
"true".equals(UtilProperties.getPropertyValue("security", "password.encrypt"));
userLogin.set("currentPassword", useEncryption ?
HashCrypt.digestHash(LoginServices.getHashType(), null, autoPassword) :
autoPassword);
userLogin.store();
