Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow upgrading between different BCrypt encodings

Browse Source 
Fixes gh-7042
This commit is contained in:
Lars Grefer
2019-06-26 22:21:57 +02:00
committed by Rob Winch
parent 4b0fb19fff
commit d3d6a8743e
4 changed files with 69 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java
View File

@@ -169,4 +169,35 @@ public class BCryptPasswordEncoderTests {
assertThat(encoder.matches("password", "012345678901234567890123456789")).isFalse();
}
@Test
public void upgradeFromLowerStrength() {
BCryptPasswordEncoder weakEncoder = new BCryptPasswordEncoder(5);
BCryptPasswordEncoder strongEncoder = new BCryptPasswordEncoder(15);
String weakPassword = weakEncoder.encode("password");
String strongPassword = strongEncoder.encode("password");
assertThat(weakEncoder.upgradeEncoding(strongPassword)).isFalse();
assertThat(strongEncoder.upgradeEncoding(weakPassword)).isTrue();
}
/**
* @see <a href="https://github.com/spring-projects/spring-security/pull/7042#issuecomment-506755496">https://github.com/spring-projects/spring-security/pull/7042#issuecomment-506755496</>
*/
@Test
public void upgradeFromNullOrEmpty() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
assertThat(encoder.upgradeEncoding(null)).isFalse();
assertThat(encoder.upgradeEncoding("")).isFalse();
}
/**
* @see <a href="https://github.com/spring-projects/spring-security/pull/7042#issuecomment-506755496">https://github.com/spring-projects/spring-security/pull/7042#issuecomment-506755496</>
*/
@Test(expected = IllegalArgumentException.class)
public void upgradeFromNonBCrypt() {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
encoder.upgradeEncoding("not-a-bcrypt-password");
}
}

8
crypto/src/test/java/org/springframework/security/crypto/password/DelegatingPasswordEncoderTests.java
View File

@@ -215,12 +215,16 @@ public class DelegatingPasswordEncoderTests {
}
@Test
public void upgradeEncodingWhenSameIdThenFalse() {
assertThat(this.passwordEncoder.upgradeEncoding(this.bcryptEncodedPassword)).isFalse();
public void upgradeEncodingWhenSameIdThenEncoderDecides() {
this.passwordEncoder.upgradeEncoding(this.bcryptEncodedPassword);
verify(bcrypt).upgradeEncoding(this.encodedPassword);
}
@Test
public void upgradeEncodingWhenDifferentIdThenTrue() {
assertThat(this.passwordEncoder.upgradeEncoding(this.noopEncodedPassword)).isTrue();
verifyZeroInteractions(bcrypt);
}
}