Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Issue #5053 

removed weak random from Masker.
This commit is contained in:
gregw 2020-07-17 17:59:57 +02:00
parent 88ec429b9c
commit 6125a07a63
1 changed files with 6 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
jetty-websocket/websocket-client/src/main/java/org/eclipse/jetty/websocket/client/masks/RandomMasker.java
View File

@ -18,6 +18,8 @@
package org.eclipse.jetty.websocket.client.masks;
import java.security.SecureRandom;
import java.util.Objects;
import java.util.Random;
import org.eclipse.jetty.websocket.common.WebSocketFrame;
@ -28,38 +30,20 @@ public class RandomMasker implements Masker
public RandomMasker()
{
this(null);
this(new SecureRandom());
}
public RandomMasker(Random random)
{
Objects.requireNonNull(random);
this.random = random;
}
@Override
public void setMask(WebSocketFrame frame)
{
byte[] mask;
if (random != null)
{
mask = new byte[4];
random.nextBytes(mask);
}
else
{
// This is a weak random, but sufficient for a mask.
// Using a SecureRandom would result in lock contention
// Using a Random is as more predictable than this algorithm
// Using a onetime random is essentially a system time.
int pseudoRandom = (int)(System.identityHashCode(frame.hashCode()) ^ System.nanoTime());
mask = new byte[]
{
(byte)pseudoRandom,
(byte)(pseudoRandom >> 8),
(byte)(pseudoRandom >> 16),
(byte)(pseudoRandom >> 24),
};
}
byte[] mask = new byte[4];
random.nextBytes(mask);
frame.setMask(mask);
}
}