(wicket) branch wicket-10.x updated: Use SecureRandom for cryptographic operations and remove SHA1PRNG dependency

[reiern70]

This is an automated email from the ASF dual-hosted git repository.

reiern70 pushed a commit to branch wicket-10.x
in repository https://gitbox.apache.org/repos/asf/wicket.git


The following commit(s) were added to refs/heads/wicket-10.x by this push:
     new ed58f856a4 Use SecureRandom for cryptographic operations and remove 
SHA1PRNG dependency
ed58f856a4 is described below

commit ed58f856a4e58d34b29dc23048bce3d33658ffb1
Author: jmestwa-coder <jmes...@gmail.com>
AuthorDate: Thu Apr 30 15:19:33 2026 +0530

    Use SecureRandom for cryptographic operations and remove SHA1PRNG dependency
    
    (cherry picked from commit 5e6f40b130a065bf689614f558e7236b8f2667a3)
---
 .../core/random/DefaultSecureRandomSupplier.java     | 20 ++++----------------
 .../org/apache/wicket/util/crypt/SunJceCrypt.java    |  5 +++--
 2 files changed, 7 insertions(+), 18 deletions(-)

diff --git 
a/wicket-core/src/main/java/org/apache/wicket/core/random/DefaultSecureRandomSupplier.java
 
b/wicket-core/src/main/java/org/apache/wicket/core/random/DefaultSecureRandomSupplier.java
index 42e12ea6dd..b471519cd4 100644
--- 
a/wicket-core/src/main/java/org/apache/wicket/core/random/DefaultSecureRandomSupplier.java
+++ 
b/wicket-core/src/main/java/org/apache/wicket/core/random/DefaultSecureRandomSupplier.java
@@ -16,14 +16,11 @@
  */
 package org.apache.wicket.core.random;
 
-import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 
-import org.apache.wicket.WicketRuntimeException;
-
 /**
- * A very simple {@link ISecureRandomSupplier} that holds a {@code 
SecureRandom} using
- * {@code SHA1PRNG}. This {@code SecureRandom} is strong enough for generation 
of nonces with a
+ * A very simple {@link ISecureRandomSupplier} that holds a {@code 
SecureRandom}. 
+ * This {@code SecureRandom} is strong enough for generation of nonces with a
  * short lifespan, but might not be strong enough for generating long-lived 
keys. When your
  * application has stronger requirements on the random implementation, you 
should replace this class
  * by your own implementation.
@@ -34,19 +31,10 @@ public class DefaultSecureRandomSupplier implements 
ISecureRandomSupplier
 {
        private static final class Holder
        {
-               private static final SecureRandom INSTANCE;
-
-               static
-               {
-                       try
-                       {
-                               INSTANCE = SecureRandom.getInstance("SHA1PRNG");
-                       } catch (NoSuchAlgorithmException e) {
-                               throw new WicketRuntimeException(e);
-                       }
-               }
+               private static final SecureRandom INSTANCE = new SecureRandom();
        }
 
+
        @Override
        public SecureRandom getRandom()
        {
diff --git 
a/wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java 
b/wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java
index f4cf621a14..52be417561 100644
--- a/wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java
+++ b/wicket-util/src/main/java/org/apache/wicket/util/crypt/SunJceCrypt.java
@@ -18,10 +18,10 @@ package org.apache.wicket.util.crypt;
 
 import java.security.GeneralSecurityException;
 import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
 import java.security.spec.AlgorithmParameterSpec;
 import java.security.spec.InvalidKeySpecException;
 import java.security.spec.KeySpec;
-import java.util.Random;
 
 import javax.crypto.Cipher;
 import javax.crypto.SecretKey;
@@ -42,6 +42,7 @@ import org.apache.wicket.util.lang.Args;
  */
 public class SunJceCrypt extends AbstractCrypt
 {
+       private static final SecureRandom SECURE_RANDOM = new SecureRandom();
        /** Name of the default encryption method */
        public static final String DEFAULT_CRYPT_METHOD = "PBEWithMD5AndDES";
 
@@ -169,7 +170,7 @@ public class SunJceCrypt extends AbstractCrypt
                // must be 8 bytes - for anything else PBES1Core throws
                // InvalidAlgorithmParameterException: Salt must be 8 bytes 
long  
                byte[] salt = new byte[8];
-               new Random().nextBytes(salt);
+               SECURE_RANDOM.nextBytes(salt);
                return salt;
        }
 }