opensource/rocketmq
3
0
Fork 0
mirror of https://github.com/apache/rocketmq.git synced 2026-08-28 20:09:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

[ISSUE #8882] Change the compare method for acl signature to improve the security. (#8883)

Browse Source 
* Change the compare method for acl signature to improve the security.

* Change the compare method for acl signature to improve the security.
This commit is contained in:
dingshuangxi888
2024-11-07 19:04:54 +08:00
committed by GitHub
parent e281697b8e
commit 851473443e
3 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
acl/src/main/java/org/apache/rocketmq/acl/common/AclUtils.java
+1 -2
View File
@@ -63,8 +63,7 @@ public class AclUtils {
}
public static String calSignature(byte[] data, String secretKey) {
String signature = AclSigner.calSignature(data, secretKey);
return signature;
return AclSigner.calSignature(data, secretKey);
}
public static void IPv6AddressCheck(String netAddress) {
acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java
+4 -1
View File
@@ -22,6 +22,7 @@ import java.nio.file.FileAlreadyExistsException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.MessageDigest;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
@@ -35,6 +36,7 @@ import org.apache.commons.lang3.StringUtils;
import org.apache.rocketmq.acl.PermissionChecker;
import org.apache.rocketmq.acl.common.AclConstants;
import org.apache.rocketmq.acl.common.AclException;
import org.apache.rocketmq.acl.common.AclSigner;
import org.apache.rocketmq.acl.common.AclUtils;
import org.apache.rocketmq.acl.common.Permission;
import org.apache.rocketmq.common.AclConfig;
@@ -618,7 +620,8 @@ public class PlainPermissionManager {
// Check the signature
String signature = AclUtils.calSignature(plainAccessResource.getContent(), ownedAccess.getSecretKey());
if (!signature.equals(plainAccessResource.getSignature())) {
if (plainAccessResource.getSignature() == null
|| !MessageDigest.isEqual(signature.getBytes(AclSigner.DEFAULT_CHARSET), plainAccessResource.getSignature().getBytes(AclSigner.DEFAULT_CHARSET))) {
throw new AclException(String.format("Check signature failed for accessKey=%s", plainAccessResource.getAccessKey()));
}
auth/src/main/java/org/apache/rocketmq/auth/authentication/chain/DefaultAuthenticationHandler.java
+3 -1
View File
@@ -16,6 +16,7 @@
*/
package org.apache.rocketmq.auth.authentication.chain;
import java.security.MessageDigest;
import java.util.concurrent.CompletableFuture;
import java.util.function.Supplier;
import org.apache.commons.lang3.StringUtils;
@@ -62,7 +63,8 @@ public class DefaultAuthenticationHandler implements Handler<DefaultAuthenticati
throw new AuthenticationException("User:{} is disabled.", context.getUsername());
}
String signature = AclSigner.calSignature(context.getContent(), user.getPassword());
if (!StringUtils.equals(signature, context.getSignature())) {
if (context.getSignature() == null
|| !MessageDigest.isEqual(signature.getBytes(AclSigner.DEFAULT_CHARSET), context.getSignature().getBytes(AclSigner.DEFAULT_CHARSET))) {
throw new AuthenticationException("check signature failed.");
}
}