Upstream/AuthMeReloaded
1
0
Fork 0
mirror of https://github.com/AuthMe/AuthMeReloaded.git synced 2024-12-31 13:07:38 +01:00
Code Issues Projects Releases Wiki Activity

#1016 Update hash algorithms list, add test that Deprecated annotation is in sync between enum and hash impl. class

Browse Source
This commit is contained in:
ljacqu 2017-10-19 21:52:55 +02:00
parent fca77b940f
commit ea824ea3f0
3 changed files with 34 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
docs/hash_algorithms.md
View File

@ -1,5 +1,5 @@
<!-- AUTO-GENERATED FILE! Do not edit this directly -->
<!-- File auto-generated on Sun Sep 17 11:29:07 CEST 2017. See docs/hashmethods/hash_algorithms.tpl.md -->
<!-- File auto-generated on Thu Oct 19 21:41:21 CEST 2017. See docs/hashmethods/hash_algorithms.tpl.md -->
## Hash Algorithms
AuthMe supports the following hash algorithms for storing your passwords safely.
@ -10,11 +10,9 @@ Algorithm | Recommendation | Hash length | ASCII | | Salt type | Length | Se
BCRYPT | Recommended | 60 | | | Text | |
BCRYPT2Y | Recommended | 60 | | | Text | 22 |
CRAZYCRYPT1 | Do not use | 128 | | | Username | |
DOUBLEMD5 | Deprecated | 32 | | | None | |
IPB3 | Acceptable | 32 | | | Text | 5 | Y
IPB4 | Does not work | 60 | | | Text | 22 | Y
JOOMLA | Acceptable | 65 | | | Text | 32 |
MD5 | Deprecated | 32 | | | None | |
MD5VB | Acceptable | 56 | | | Text | 16 |
MYBB | Acceptable | 32 | | | Text | 8 | Y
PBKDF2 | Recommended | 165 | | | Text | 16 |
@ -24,14 +22,11 @@ PHPFUSION | Do not use | 64 | Y | | | | Y
ROYALAUTH | Do not use | 128 | | | None | |
SALTED2MD5 | Acceptable | 32 | | | Text | | Y
SALTEDSHA512 | Recommended | 128 | | | | | Y
SHA1 | Deprecated | 40 | | | None | |
SHA256 | Recommended | 86 | | | Text | 16 |
SHA512 | Deprecated | 128 | | | None | |
SMF | Do not use | 40 | | | Username | |
SMF | Do not use | 40 | | | Username | | Y
TWO_FACTOR | Does not work | 16 | | | None | |
WBB3 | Acceptable | 40 | | | Text | 40 | Y
WBB4 | Recommended | 60 | | | Text | 8 |
WHIRLPOOL | Deprecated | 128 | | | None | |
WORDPRESS | Acceptable | 34 | | | Text | 9 |
XAUTH | Recommended | 140 | | | Text | 12 |
XFBCRYPT | | 60 | | | | |
@ -83,4 +78,4 @@ or bad.
---
This page was automatically generated on the [AuthMe/AuthMeReloaded repository](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/) on Sun Sep 17 11:29:07 CEST 2017
This page was automatically generated on the [AuthMe/AuthMeReloaded repository](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/) on Thu Oct 19 21:41:21 CEST 2017

5
src/main/java/fr/xephi/authme/settings/SettingsMigrationService.java
View File

@ -11,7 +11,6 @@ import fr.xephi.authme.output.LogLevel;
import fr.xephi.authme.process.register.RegisterSecondaryArgument;
import fr.xephi.authme.process.register.RegistrationType;
import fr.xephi.authme.security.HashAlgorithm;
import fr.xephi.authme.security.crypts.EncryptionMethod;
import fr.xephi.authme.settings.properties.PluginSettings;
import fr.xephi.authme.settings.properties.RegistrationSettings;
import fr.xephi.authme.settings.properties.SecuritySettings;
@ -301,8 +300,8 @@ public class SettingsMigrationService extends PlainMigrationService {
HashAlgorithm currentHash = SecuritySettings.PASSWORD_HASH.getValue(resource);
// Skip CUSTOM (has no class) and PLAINTEXT (is force-migrated later on in the startup process)
if (currentHash != HashAlgorithm.CUSTOM && currentHash != HashAlgorithm.PLAINTEXT) {
Class<? extends EncryptionMethod> clazz = currentHash.getClazz();
if (clazz.isAnnotationPresent(Deprecated.class)) {
Class<?> encryptionClass = currentHash.getClazz();
if (encryptionClass.isAnnotationPresent(Deprecated.class)) {
resource.setValue(SecuritySettings.PASSWORD_HASH.getPath(), HashAlgorithm.SHA256);
Set<HashAlgorithm> legacyHashes = SecuritySettings.LEGACY_HASHES.getValue(resource);
legacyHashes.add(currentHash);

29
src/test/java/fr/xephi/authme/security/HashAlgorithmIntegrationTest.java
View File

@ -4,6 +4,8 @@ import ch.jalu.injector.Injector;
import ch.jalu.injector.InjectorBuilder;
import fr.xephi.authme.security.crypts.EncryptionMethod;
import fr.xephi.authme.security.crypts.HashedPassword;
import fr.xephi.authme.security.crypts.description.Recommendation;
import fr.xephi.authme.security.crypts.description.Usage;
import fr.xephi.authme.settings.Settings;
import fr.xephi.authme.settings.properties.HooksSettings;
import fr.xephi.authme.settings.properties.SecuritySettings;
@ -12,6 +14,8 @@ import org.junit.BeforeClass;
import org.junit.Test;
import java.util.HashSet;
import java.util.LinkedList;
import java.util.List;
import java.util.Set;
import static org.hamcrest.Matchers.equalTo;
@ -70,4 +74,29 @@ public class HashAlgorithmIntegrationTest {
}
}
@Test
public void shouldBeDeprecatedIfEncryptionClassIsDeprecated() throws NoSuchFieldException {
// given
List<String> failedEntries = new LinkedList<>();
// when
for (HashAlgorithm hashAlgorithm : HashAlgorithm.values()) {
if (hashAlgorithm != HashAlgorithm.CUSTOM) {
boolean isEnumDeprecated = HashAlgorithm.class.getDeclaredField(hashAlgorithm.name())
.isAnnotationPresent(Deprecated.class);
boolean isDeprecatedClass = hashAlgorithm.getClazz().isAnnotationPresent(Deprecated.class);
Recommendation recommendation = hashAlgorithm.getClazz().getAnnotation(Recommendation.class);
boolean hasDeprecatedUsage = recommendation != null && recommendation.value() == Usage.DEPRECATED;
if (isEnumDeprecated != isDeprecatedClass || isEnumDeprecated != hasDeprecatedUsage) {
failedEntries.add(hashAlgorithm + ": enum @Deprecated = " + isEnumDeprecated
+ ", @Deprecated class = " + isDeprecatedClass + ", usage Deprecated = " + hasDeprecatedUsage);
}
}
}
// then
if (!failedEntries.isEmpty()) {
fail("Found inconsistencies:\n" + String.join("\n", failedEntries));
}
}
}