public/openhab-addons
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use SecureRandom instead of Random (#15459)

Browse Source 
Make sure that SecureRadom is used whenever the random number
is used for cryptographic operations, e.g. as nonce/salt.

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
This commit is contained in:
Holger Friedrich
2023-08-20 21:29:37 +02:00
committed by GitHub
parent e86998000e
commit 95ac2eb80b
7 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
bundles/org.openhab.binding.ipcamera/src/main/java/org/openhab/binding/ipcamera/internal/MyNettyAuthHandler.java
View File

@@ -14,6 +14,7 @@ package org.openhab.binding.ipcamera.internal;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Random;
import org.eclipse.jdt.annotation.NonNullByDefault;
@@ -117,7 +118,7 @@ public class MyNettyAuthHandler extends ChannelDuplexHandler {
// create the MD5 hashes
String ha1 = username + ":" + realm + ":" + password;
ha1 = calcMD5Hash(ha1);
Random random = new Random();
Random random = new SecureRandom();
String cnonce = Integer.toHexString(random.nextInt());
ncCounter = (ncCounter > 125) ? 1 : ++ncCounter;
String nc = String.format("%08X", ncCounter); // 8 digit hex number

3
bundles/org.openhab.binding.ipcamera/src/main/java/org/openhab/binding/ipcamera/internal/onvif/OnvifConnection.java
View File

@@ -18,6 +18,7 @@ import java.net.InetSocketAddress;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Base64;
@@ -478,7 +479,7 @@ public class OnvifConnection {
}
String createNonce() {
Random nonce = new Random();
Random nonce = new SecureRandom();
return "" + nonce.nextInt();
}