From 90cce51e418e7fa8636033a4d6b96cc3bb49641b Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Thu, 30 Jul 2026 13:48:20 +0000
Subject: [PATCH] Fix CodeQL warning-severity alerts: weak salt PRNG, unsafe DCL, thread-unsafe date formats (#789)
---
opendj-server-legacy/src/main/java/org/opends/server/extensions/Sha2Crypt.java | 11 ++++++++---
1 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/extensions/Sha2Crypt.java b/opendj-server-legacy/src/main/java/org/opends/server/extensions/Sha2Crypt.java
index 9bd20cf..99c59fc 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/extensions/Sha2Crypt.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/extensions/Sha2Crypt.java
@@ -34,8 +34,8 @@
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
import java.util.Arrays;
-import java.util.Random;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -82,6 +82,12 @@
"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
/**
+ * Source of randomness used to generate salts. A single shared instance is used because
+ * {@code SecureRandom} is thread-safe and reseeding it for every value would weaken it.
+ */
+ private static final SecureRandom SALT_RANDOM = new SecureRandom();
+
+ /**
* Base64 like conversion of bytes to ASCII chars.
*
* @param b2
@@ -120,8 +126,7 @@
static String getRandomSalt(int num) {
StringBuilder saltString = new StringBuilder();
for (int i = 1; i <= num; i++) {
- saltString.append(B64T.charAt(new Random().
- nextInt(B64T.length())));
+ saltString.append(B64T.charAt(SALT_RANDOM.nextInt(B64T.length())));
}
return saltString.toString();
}
--
Gitblit v1.10.0