From 65111c6f7556527decee160246183cf1b865587e Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 29 Jul 2026 15:05:30 +0000
Subject: [PATCH] Fix type-mismatch, index-out-of-bounds and boxed-equality CodeQL alerts (#782)
---
opendj-server-legacy/src/test/java/org/opends/server/extensions/BCryptTest.java | 13 +++++++++++++
1 files changed, 13 insertions(+), 0 deletions(-)
diff --git a/opendj-server-legacy/src/test/java/org/opends/server/extensions/BCryptTest.java b/opendj-server-legacy/src/test/java/org/opends/server/extensions/BCryptTest.java
index 926c134..865a394 100644
--- a/opendj-server-legacy/src/test/java/org/opends/server/extensions/BCryptTest.java
+++ b/opendj-server-legacy/src/test/java/org/opends/server/extensions/BCryptTest.java
@@ -24,6 +24,7 @@
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * Portions Copyright 2026 3A Systems, LLC.
*
*/
@@ -198,6 +199,18 @@
}
/**
+ * A stored password whose salt holds a character beyond the base64 decoding table
+ * must fail with the IllegalArgumentException that
+ * BcryptPasswordStorageScheme.passwordMatches() catches, and not with an
+ * ArrayIndexOutOfBoundsException escaping into bind processing.
+ */
+ @Test(expectedExceptions = IllegalArgumentException.class)
+ public void checkPwRejectsSaltCharBeyondDecodingTable() {
+ // U+0080 is the first character past the end of the 128 entry index_64 table.
+ BCrypt.checkpw("secret", "$2a$10$" + ((char) 0x80) + "aaaaaaaaaaaaaaaaaaaaa");
+ }
+
+ /**
* Test for correct hashing of non-US-ASCII passwords.
*/
@Test
--
Gitblit v1.10.0