SEC-1031: LdapShaPasswordEncoder.isPasswordValid startOfHash off by one

http://jira.springframework.org/browse/SEC-1031. Fixed startOfHash value and added tests to check full length of password is used.

core/src/main/java/org/springframework/security/providers/ldap/authenticator/LdapShaPasswordEncoder.java

@@ -145,7 +145,7 @@ public class LdapShaPasswordEncoder implements PasswordEncoder {
             salt = null;
         }
 
-        int startOfHash = prefix.length() + 1;
+        int startOfHash = prefix.length();
 
         String encodedRawPass = encodePassword(rawPass, salt).substring(startOfHash);
 

core/src/test/java/org/springframework/security/providers/ldap/authenticator/LdapShaPasswordEncoderTests.java

@@ -81,6 +81,15 @@ public class LdapShaPasswordEncoderTests {
         assertTrue(sha.isPasswordValid("{ssha}PQy2j+6n5ytA+YlAKkM8Fh4p6u2JxfVd", "boabspasswurd", null));
     }
 
+    @Test
+    // SEC-1031
+    public void fullLengthOfHashIsUsedInComparison() throws Exception {
+        // Change the first hash character from '2' to '3'
+        assertFalse(sha.isPasswordValid("{SSHA}35ro4PKC8jhQZ26jVsozhX/xaP0suHgX", "boabspasswurd", null));
+     // Change the last hash character from 'X' to 'Y'
+        assertFalse(sha.isPasswordValid("{SSHA}25ro4PKC8jhQZ26jVsozhX/xaP0suHgY", "boabspasswurd", null));
+    }
+
     @Test
     public void correctPrefixCaseIsUsed() {
         sha.setForceLowerCasePrefix(false);