From 7fc458b7be71111b4c4a6e91f7b3ed6642b104a1 Mon Sep 17 00:00:00 2001
From: Chris Ridd <chris.ridd@forgerock.com>
Date: Tue, 16 Jul 2013 14:12:20 +0000
Subject: [PATCH] CR-2005 Fix OPENDJ-1036 Cleanup passwords in memory?
---
opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java | 30 +++++++++++++++++++++++++++---
1 files changed, 27 insertions(+), 3 deletions(-)
diff --git a/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java b/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
index 49bd575..d3278e1 100644
--- a/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
+++ b/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
@@ -23,7 +23,7 @@
*
*
* Copyright 2006-2010 Sun Microsystems, Inc.
- * Portions Copyright 2010 ForgeRock AS.
+ * Portions Copyright 2010-2013 ForgeRock AS.
*/
package org.opends.server.extensions;
@@ -190,6 +190,10 @@
throw new DirectoryException(DirectoryServer.getServerErrorResultCode(),
message, e);
}
+ finally
+ {
+ Arrays.fill(plainPlusSalt, (byte) 0);
+ }
}
// Append the salt to the hashed value and base64-the whole thing.
@@ -248,6 +252,10 @@
throw new DirectoryException(DirectoryServer.getServerErrorResultCode(),
message, e);
}
+ finally
+ {
+ Arrays.fill(plainPlusSalt, (byte) 0);
+ }
}
// Append the salt to the hashed value and base64-the whole thing.
@@ -330,6 +338,10 @@
return false;
}
+ finally
+ {
+ Arrays.fill(plainPlusSalt, (byte) 0);
+ }
}
return Arrays.equals(digestBytes, userDigestBytes);
@@ -399,6 +411,10 @@
throw new DirectoryException(DirectoryServer.getServerErrorResultCode(),
message, e);
}
+ finally
+ {
+ Arrays.fill(plainPlusSalt, (byte) 0);
+ }
}
@@ -448,8 +464,15 @@
synchronized (digestLock)
{
- return Arrays.equals(digestBytes,
- messageDigest.digest(plainPlusSaltBytes));
+ try
+ {
+ return Arrays.equals(digestBytes,
+ messageDigest.digest(plainPlusSaltBytes));
+ }
+ finally
+ {
+ Arrays.fill(plainPlusSaltBytes, (byte) 0);
+ }
}
}
@@ -550,6 +573,7 @@
System.arraycopy(digestBytes, 0, digestPlusSalt, 0, digestBytes.length);
System.arraycopy(saltBytes, 0, digestPlusSalt, digestBytes.length,
NUM_SALT_BYTES);
+ Arrays.fill(passwordPlusSalt, (byte) 0);
return "{" + STORAGE_SCHEME_NAME_SALTED_SHA_1 + "}" +
Base64.encode(digestPlusSalt);
--
Gitblit v1.10.0