From c2296b0376d749aec43a1d68667d39116ccf3bf2 Mon Sep 17 00:00:00 2001 From: Alan Czajkowski Date: Sat, 4 Apr 2020 12:46:11 -0400 Subject: [PATCH] BCryptPasswordEncoder rawPassword cannot be null Closes gh-8317 --- .../security/crypto/bcrypt/BCryptPasswordEncoder.java | 8 ++++++++ .../crypto/bcrypt/BCryptPasswordEncoderTests.java | 11 +++++++++++ 2 files changed, 19 insertions(+) diff --git a/crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java b/crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java index e0b80e5dd0..c1ad734aeb 100644 --- a/crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java +++ b/crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java @@ -65,6 +65,10 @@ public class BCryptPasswordEncoder implements PasswordEncoder { } public String encode(CharSequence rawPassword) { + if (rawPassword == null) { + throw new IllegalArgumentException("rawPassword cannot be null"); + } + String salt; if (strength > 0) { if (random != null) { @@ -81,6 +85,10 @@ public class BCryptPasswordEncoder implements PasswordEncoder { } public boolean matches(CharSequence rawPassword, String encodedPassword) { + if (rawPassword == null) { + throw new IllegalArgumentException("rawPassword cannot be null"); + } + if (encodedPassword == null || encodedPassword.length() == 0) { logger.warn("Empty encoded password"); return false; diff --git a/crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java b/crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java index d637c085f4..ec34e95c5b 100644 --- a/crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java +++ b/crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java @@ -92,4 +92,15 @@ public class BCryptPasswordEncoderTests { assertThat(encoder.matches("password", "012345678901234567890123456789")).isFalse(); } + @Test(expected = IllegalArgumentException.class) + public void encodeNullRawPassword() { + BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); + encoder.encode(null); + } + + @Test(expected = IllegalArgumentException.class) + public void matchNullRawPassword() { + BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); + encoder.matches(null, "does-not-matter"); + } }