SEC-1890: make illegal arguments more obvious in BCrypt

crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java

@@ -651,6 +651,10 @@ public static String hashpw(String password, String salt) {
         char minor = (char)0;
         int rounds, off = 0;
         StringBuffer rs = new StringBuffer();
+
+        if (salt==null || salt.length()<4) {
+            throw new IllegalArgumentException ("Invalid salt length");      	
+        }
 
         if (salt.charAt(0) != '$' || salt.charAt(1) != '2')
             throw new IllegalArgumentException ("Invalid salt version");
@@ -663,7 +667,11 @@ public static String hashpw(String password, String salt) {
             off = 4;
         }
 
-        // Extract number of rounds
+        if (salt.length()<off+25) {
+            throw new IllegalArgumentException ("Invalid real salt length");      	
+        }
+
+       // Extract number of rounds
         if (salt.charAt(off + 2) > '$')
             throw new IllegalArgumentException ("Missing salt rounds");
         rounds = Integer.parseInt(salt.substring(off, off + 2));

crypto/src/main/java/org/springframework/security/crypto/codec/Utf8.java

@@ -4,7 +4,6 @@
 import java.nio.CharBuffer;
 import java.nio.charset.CharacterCodingException;
 import java.nio.charset.Charset;
-import java.util.*;
 
 /**
  * UTF-8 Charset encoder/decoder.

crypto/src/main/java/org/springframework/security/crypto/keygen/SecureRandomBytesKeyGenerator.java

@@ -15,8 +15,6 @@
  */
 package org.springframework.security.crypto.keygen;
 
-import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
 import java.security.SecureRandom;
 
 /**

crypto/src/main/java/org/springframework/security/crypto/password/Digester.java

@@ -17,7 +17,6 @@
 
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
 
 /**
  * Helper for working with the MessageDigest API.

crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java

@@ -18,43 +18,83 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
-import org.junit.Test;
+import java.security.SecureRandom;
 
+import org.junit.Test;
 
 /**
  * @author Dave Syer
- *
+ * 
  */
 public class BCryptPasswordEncoderTests {
 
-    @Test
-    public void matches() {
-        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
-        String result = encoder.encode("password");
-        assertFalse(result.equals("password"));
-        assertTrue(encoder.matches("password", result));
-    }
-
-    @Test
-    public void unicode() {
-        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
-        String result = encoder.encode("passw\u9292rd");
-        assertFalse(encoder.matches("pass\u9292\u9292rd", result));
-        assertTrue(encoder.matches("passw\u9292rd", result));
-    }
-
-    @Test
-    public void matchesLengthChecked() {
-        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
-        String result = encoder.encode("password");
-        assertFalse(encoder.matches("password", result.substring(0,result.length()-2)));
-    }
-
-    @Test
-    public void notMatches() {
-        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
-        String result = encoder.encode("password");
-        assertFalse(encoder.matches("bogus", result));
-    }
+	@Test
+	public void matches() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		String result = encoder.encode("password");
+		assertFalse(result.equals("password"));
+		assertTrue(encoder.matches("password", result));
+	}
+
+	@Test
+	public void customStrength() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(8);
+		String result = encoder.encode("password");
+		assertTrue(encoder.matches("password", result));
+	}
+
+	@Test
+	public void customRandom() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(8, new SecureRandom());
+		String result = encoder.encode("password");
+		assertTrue(encoder.matches("password", result));
+	}
+
+	@Test
+	public void unicode() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		String result = encoder.encode("passw\u9292rd");
+		assertFalse(encoder.matches("pass\u9292\u9292rd", result));
+		assertTrue(encoder.matches("passw\u9292rd", result));
+	}
+
+	@Test
+	public void matchesLengthChecked() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		String result = encoder.encode("password");
+		assertFalse(encoder.matches("password", result.substring(0, result.length() - 2)));
+	}
+
+	@Test
+	public void notMatches() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		String result = encoder.encode("password");
+		assertFalse(encoder.matches("bogus", result));
+	}
+
+	@Test(expected=IllegalArgumentException.class)
+	public void barfsOnNullEncodedValue() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		assertFalse(encoder.matches("password", null));
+	}
+
+	@Test(expected=IllegalArgumentException.class)
+	public void barfsOnEmptyEncodedValue() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		assertFalse(encoder.matches("password", ""));
+	}
+
+	@Test(expected=IllegalArgumentException.class)
+	public void barfsOnShortEncodedValue() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		String result = encoder.encode("password");
+		assertFalse(encoder.matches("password", result.substring(0, 4)));
+	}
+
+	@Test(expected=IllegalArgumentException.class)
+	public void barfsOnBogusEncodedValue() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		assertFalse(encoder.matches("password", "012345678901234567890123456789"));
+	}
 
 }

crypto/src/test/java/org/springframework/security/crypto/password/DigesterTests.java

@@ -1,15 +1,10 @@
 package org.springframework.security.crypto.password;
 
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-
-import java.security.MessageDigest;
-import java.util.Arrays;
 
 import org.junit.Test;
 import org.springframework.security.crypto.codec.Hex;
 import org.springframework.security.crypto.codec.Utf8;
-import org.springframework.security.crypto.password.Digester;
 
 public class DigesterTests {