From 5a2a992ee6143d605f358a9f6379e7916e346def Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Fri, 24 Jul 2026 09:38:43 +0000
Subject: [PATCH] Fix java/insecure-randomness CodeQL alerts by using SecureRandom (#758)
---
opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java | 9 +++++----
opendj-ldap-toolkit/src/main/java/com/forgerock/opendj/ldap/tools/AuthRate.java | 11 ++++++-----
opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java | 9 +++++----
3 files changed, 16 insertions(+), 13 deletions(-)
diff --git a/opendj-ldap-toolkit/src/main/java/com/forgerock/opendj/ldap/tools/AuthRate.java b/opendj-ldap-toolkit/src/main/java/com/forgerock/opendj/ldap/tools/AuthRate.java
index b8ea716..06d5b16 100644
--- a/opendj-ldap-toolkit/src/main/java/com/forgerock/opendj/ldap/tools/AuthRate.java
+++ b/opendj-ldap-toolkit/src/main/java/com/forgerock/opendj/ldap/tools/AuthRate.java
@@ -13,6 +13,7 @@
*
* Copyright 2010 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
*/
package com.forgerock.opendj.ldap.tools;
@@ -25,11 +26,11 @@
import static com.forgerock.opendj.cli.CommonArguments.*;
import java.io.PrintStream;
+import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.Collections;
import java.util.LinkedList;
import java.util.List;
-import java.util.Random;
import com.codahale.metrics.RatioGauge;
import com.forgerock.opendj.cli.MultiColumnPrinter;
@@ -108,10 +109,10 @@
private Object[] data;
private final char[] invalidPassword = "invalid-password".toCharArray();
- private final ThreadLocal<Random> rng = new ThreadLocal<Random>() {
+ private final ThreadLocal<SecureRandom> rng = new ThreadLocal<SecureRandom>() {
@Override
- protected Random initialValue() {
- return new Random();
+ protected SecureRandom initialValue() {
+ return new SecureRandom();
}
};
@@ -183,7 +184,7 @@
useInvalidPassword = true;
break;
default:
- final Random r = rng.get();
+ final SecureRandom r = rng.get();
final int p = r.nextInt(100);
useInvalidPassword = p < invalidCredPercent;
break;
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java b/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
index c03357c..afb064c 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
@@ -13,12 +13,13 @@
*
* Copyright 2006-2010 Sun Microsystems, Inc.
* Portions Copyright 2010-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
*/
package org.opends.server.extensions;
import java.security.MessageDigest;
+import java.security.SecureRandom;
import java.util.Arrays;
-import java.util.Random;
import org.forgerock.i18n.LocalizableMessage;
import org.forgerock.opendj.ldap.Base64;
@@ -69,7 +70,7 @@
private Object digestLock;
/** The secure random number generator to use to generate the salt values. */
- private Random random;
+ private SecureRandom random;
/**
* Creates a new instance of this password storage scheme. Note that no
@@ -99,7 +100,7 @@
}
digestLock = new Object();
- random = new Random();
+ random = new SecureRandom();
}
@Override
@@ -422,7 +423,7 @@
throws DirectoryException
{
byte[] saltBytes = new byte[NUM_SALT_BYTES];
- new Random().nextBytes(saltBytes);
+ new SecureRandom().nextBytes(saltBytes);
byte[] passwordPlusSalt = new byte[passwordBytes.length + NUM_SALT_BYTES];
System.arraycopy(passwordBytes, 0, passwordPlusSalt, 0,
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java b/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java
index 7e2f683..1fa32d9 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java
@@ -13,12 +13,13 @@
*
* Copyright 2006-2008 Sun Microsystems, Inc.
* Portions Copyright 2010-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
*/
package org.opends.server.extensions;
import java.security.MessageDigest;
+import java.security.SecureRandom;
import java.util.Arrays;
-import java.util.Random;
import org.forgerock.i18n.LocalizableMessage;
import org.forgerock.opendj.ldap.Base64;
@@ -69,7 +70,7 @@
private Object digestLock;
/** The secure random number generator to use to generate the salt values. */
- private Random random;
+ private SecureRandom random;
/**
* Creates a new instance of this password storage scheme. Note that no
@@ -101,7 +102,7 @@
}
digestLock = new Object();
- random = new Random();
+ random = new SecureRandom();
}
@Override
@@ -426,7 +427,7 @@
throws DirectoryException
{
byte[] saltBytes = new byte[NUM_SALT_BYTES];
- new Random().nextBytes(saltBytes);
+ new SecureRandom().nextBytes(saltBytes);
byte[] passwordPlusSalt = new byte[passwordBytes.length + NUM_SALT_BYTES];
System.arraycopy(passwordBytes, 0, passwordPlusSalt, 0,
--
Gitblit v1.10.0