PasswordUtil { public static boolean isSame(@Nullable String hashedPassword, @NotNull char[] password) { return isSame(hashedPassword, String.valueOf(password)); } private  PasswordUtil(); static String buildPasswordHash(@NotNull String password); static String buildPasswordHash(@NotNull String password,
                                           @Nullable String algorithm,
                                           int saltSize, int iterations); static String buildPasswordHash(@NotNull String password,
                                           @NotNull ConfigurationParameters config); static boolean isPlainTextPassword(@Nullable String password); static boolean isSame(@Nullable String hashedPassword, @NotNull char[] password); static boolean isSame(@Nullable String hashedPassword, @NotNull String password); static final String DEFAULT_ALGORITHM; static final int DEFAULT_SALT_SIZE; static final int DEFAULT_ITERATIONS; }
@Test public void testBuildPasswordHashNoSaltNoIterations() throws Exception { assumeFalse(DEFAULT_ALGORITHM.startsWith(PasswordUtil.PBKDF2_PREFIX)); String jr2Hash = "{"+ DEFAULT_ALGORITHM+"}" + Text.digest(DEFAULT_ALGORITHM, "pw".getBytes("utf-8")); assertTrue(PasswordUtil.isSame(jr2Hash, "pw")); }
@Test public void testIsSame() throws Exception { for (String pw : hashedPasswords.keySet()) { String pwHash = hashedPasswords.get(pw); assertTrue("Not the same " + pw + ", " + pwHash, PasswordUtil.isSame(pwHash, pw)); } String pw = "password"; String pwHash = PasswordUtil.buildPasswordHash(pw, "SHA-1", 4, 50); assertTrue("Not the same '" + pw + "', " + pwHash, PasswordUtil.isSame(pwHash, pw)); assertTrue("Not the same '" + pw + "', " + pwHash, PasswordUtil.isSame(pwHash, pw.toCharArray())); pwHash = PasswordUtil.buildPasswordHash(pw, "md5", 0, 5); assertTrue("Not the same '" + pw + "', " + pwHash, PasswordUtil.isSame(pwHash, pw)); assertTrue("Not the same '" + pw + "', " + pwHash, PasswordUtil.isSame(pwHash, pw.toCharArray())); pwHash = PasswordUtil.buildPasswordHash(pw, "md5", -1, -1); assertTrue("Not the same '" + pw + "', " + pwHash, PasswordUtil.isSame(pwHash, pw)); assertTrue("Not the same '" + pw + "', " + pwHash, PasswordUtil.isSame(pwHash, pw.toCharArray())); }
@Test public void testIsNotSame() { String previous = null; for (String pw : hashedPasswords.keySet()) { String pwHash = hashedPasswords.get(pw); assertFalse(pw, PasswordUtil.isSame(pw, pw)); assertFalse(pwHash, PasswordUtil.isSame(pwHash, pwHash)); if (previous != null) { assertFalse(previous, PasswordUtil.isSame(pwHash, previous)); } previous = pw; } }
@Test public void testIsSameNullHash() { assertFalse(PasswordUtil.isSame(null, "pw")); }
@Test public void testIsSameEmptyHash() { assertFalse(PasswordUtil.isSame("", "pw")); }