Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Initialize KeyStoreConfiguration without password.

Browse Source 
We now initialize KeyStoreConfiguration without a password to prevent unintended keystore integrity. Previously we initialized the password with an empty char array which triggered a password check/integrity verification and caused a false keystore tampering alert.

Fixes gh-131.
This commit is contained in:
Mark Paluch
2017-08-30 11:51:35 +02:00
parent be20e49198
commit 0ca5de03df
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java
View File

@@ -331,7 +331,7 @@ public class SslConfiguration {
public static class KeyStoreConfiguration {
private static final KeyStoreConfiguration UNCONFIGURED = new KeyStoreConfiguration(
AbsentResource.INSTANCE, new char[0], DEFAULT_KEYSTORE_TYPE);
AbsentResource.INSTANCE, null, DEFAULT_KEYSTORE_TYPE);
/**
* Store that holds certificates, private keys.
@@ -380,7 +380,7 @@ public class SslConfiguration {
* @since 2.0
*/
public static KeyStoreConfiguration of(Resource resource) {
return new KeyStoreConfiguration(resource, new char[0], DEFAULT_KEYSTORE_TYPE);
return new KeyStoreConfiguration(resource, null, DEFAULT_KEYSTORE_TYPE);
}
/**