Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove unsafe/deprecated Encryptors.querableText(CharSequence,CharSequence)

Browse Source 
This method is insecure. Users should instead encrypt with their database.

Closes gh-8980
This commit is contained in:
Rob Winch
2022-09-07 13:51:58 -05:00
parent 088ebe2e00
commit d996c2a2c6
4 changed files with 5 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
crypto/src/test/java/org/springframework/security/crypto/encrypt/EncryptorsTests.java
View File

@@ -66,17 +66,6 @@ public class EncryptorsTests {
assertThat(result.equals(encryptor.encrypt("text"))).isFalse();
}
@Test
public void queryableText() {
CryptoAssumptions.assumeCBCJCE();
TextEncryptor encryptor = Encryptors.queryableText("password", "5c0744940b5c369b");
String result = encryptor.encrypt("text");
assertThat(result).isNotNull();
assertThat(result.equals("text")).isFalse();
assertThat(encryptor.decrypt(result)).isEqualTo("text");
assertThat(result.equals(encryptor.encrypt("text"))).isTrue();
}
@Test
public void noOpText() {
TextEncryptor encryptor = Encryptors.noOpText();