ConfigSecurity { @SuppressFBWarnings("DLS_DEAD_LOCAL_STORE") public Boolean verifyParentPassword(final String application, final String parentApplication, final String token, final String expectedParentPassword) { final Boolean result; if (!this.securityEnabled) { result = isNotEmpty(application) && isNotEmpty(parentApplication); } else { final String rawParentPassword = this.decryptProperty(expectedParentPassword); if (isNotEmpty(application) && isNotEmpty(token)) { if (token.startsWith(TOKEN_PREFIX)) { final String rawToken = token.replace(TOKEN_PREFIX, ""); final String encrypted = this.hmacVerifier.verify(rawToken).getClaim(TOKEN_CLAIM).asString(); final String plainText = this.encryptor.decrypt(encrypted); final Iterator<String> parts = CONCAT_PATTERN.splitAsStream(plainText).iterator(); final String random = parts.next(); final String encodedApplication = parts.next(); final String encodedParentApplication = parts.next(); final String encodedParentPassword = parts.next(); try { result = this.passwordEncoder.matches(application, encodedApplication) && this.passwordEncoder.matches(parentApplication, encodedParentApplication) && this.passwordEncoder.matches(rawParentPassword, encodedParentPassword); } catch (final Exception ignored) { return FALSE; } } else { final String rawToken = this.decryptProperty(token); result = this.isPasswordMatch(rawParentPassword, rawToken); } } else { if (isNotEmpty(application) && isNotEmpty(parentApplication)) { result = this.isPasswordMatch(rawParentPassword, token); } else { result = FALSE; } } } return result; } ConfigSecurity(); @Autowired void setEncryptorLocator(final TextEncryptorLocator encryptorLocator); @PostConstruct @SneakyThrows void init(); String encryptParentPassword(final String application, final String parentApplication, final String parentPassword); @SuppressFBWarnings("DLS_DEAD_LOCAL_STORE") Boolean verifyParentPassword(final String application, final String parentApplication, final String token, final String expectedParentPassword);  }
@Test public void testVerifyNonTokenParentPassword() { final String application = "application"; final String parentApplication = "parent-application"; final String parentPassword = "parent-application_pass"; final String encryptedParentPassword = "{cipher}" + this.encryptor.encrypt(parentPassword); assertTrue(this.configSecurity.verifyParentPassword(application, parentApplication, parentPassword, parentPassword)); assertTrue(this.configSecurity.verifyParentPassword(application, parentApplication, parentPassword, encryptedParentPassword)); assertTrue(this.configSecurity.verifyParentPassword(application, parentApplication, encryptedParentPassword, parentPassword)); assertTrue(this.configSecurity.verifyParentPassword(application, "", parentPassword, parentPassword)); assertTrue(this.configSecurity.verifyParentPassword(application, null, parentPassword, parentPassword)); assertFalse(this.configSecurity.verifyParentPassword("", parentPassword, parentPassword, parentPassword)); assertFalse(this.configSecurity.verifyParentPassword(null, parentPassword, parentPassword, parentPassword)); assertFalse(this.configSecurity.verifyParentPassword(application, parentApplication, parentPassword + "x", parentPassword)); assertFalse(this.configSecurity.verifyParentPassword(application, parentApplication, parentPassword, parentPassword + "x")); }
@Test public void testVerifyEmptyParentPassword() { final String application = "application"; final String parentApplication = "parent-application"; assertTrue(this.configSecurity.verifyParentPassword(application, parentApplication, "", null)); assertTrue(this.configSecurity.verifyParentPassword(application, parentApplication, null, "")); assertTrue(this.configSecurity.verifyParentPassword(application, parentApplication, null, null)); assertFalse(this.configSecurity.verifyParentPassword(application, "", null, null)); assertFalse(this.configSecurity.verifyParentPassword(application, null, null, null)); assertFalse(this.configSecurity.verifyParentPassword("", parentApplication, null, null)); assertFalse(this.configSecurity.verifyParentPassword(null, parentApplication, null, null)); }