Merge pull request dschadow#236 from dschadow/dependabot/maven/org.apache.shiro-shiro-core-2.0.1

dschadow · web-flow · commit eb833c704e9e · 2024-06-08T17:17:28.000+02:00
Bump org.apache.shiro:shiro-core from 1.13.0 to 2.0.1
diff --git a/crypto-shiro/src/main/java/de/dominikschadow/javasecurity/hash/SHA512.java b/crypto-shiro/src/main/java/de/dominikschadow/javasecurity/hash/SHA512.java
@@ -20,7 +20,7 @@
 import org.apache.shiro.crypto.hash.DefaultHashService;
 import org.apache.shiro.crypto.hash.Hash;
 import org.apache.shiro.crypto.hash.HashRequest;
-import org.apache.shiro.util.ByteSource;
+import org.apache.shiro.lang.util.ByteSource;
 
 import java.util.Arrays;
 
@@ -35,30 +35,26 @@ public class SHA512 {
      * Nothing up my sleeve number as private salt, not good for production.
      */
     private static final byte[] PRIVATE_SALT_BYTES = {3, 1, 4, 1, 5, 9, 2, 6, 5};
-    private static final int ITERATIONS = 1000000;
 
     public Hash calculateHash(String password) {
         ByteSource privateSalt = ByteSource.Util.bytes(PRIVATE_SALT_BYTES);
         DefaultHashService hashService = new DefaultHashService();
-        hashService.setPrivateSalt(privateSalt);
-        hashService.setGeneratePublicSalt(true);
-        hashService.setHashIterations(ITERATIONS);
 
         HashRequest.Builder builder = new HashRequest.Builder();
         builder.setSource(ByteSource.Util.bytes(password));
+        builder.setSalt(privateSalt);
+        builder.setAlgorithmName("SHA-512");
 
         return hashService.computeHash(builder.build());
     }
 
     public boolean verifyPassword(byte[] originalHash, ByteSource publicSalt, String password) {
-        ByteSource privateSalt = ByteSource.Util.bytes(PRIVATE_SALT_BYTES);
         DefaultHashService hashService = new DefaultHashService();
-        hashService.setPrivateSalt(privateSalt);
-        hashService.setHashIterations(ITERATIONS);
 
         HashRequest.Builder builder = new HashRequest.Builder();
         builder.setSource(ByteSource.Util.bytes(password));
         builder.setSalt(publicSalt);
+        builder.setAlgorithmName("SHA-512");
 
         Hash comparisonHash = hashService.computeHash(builder.build());
 
diff --git a/crypto-shiro/src/main/java/de/dominikschadow/javasecurity/symmetric/AES.java b/crypto-shiro/src/main/java/de/dominikschadow/javasecurity/symmetric/AES.java
@@ -17,8 +17,9 @@
  */
 package de.dominikschadow.javasecurity.symmetric;
 
-import org.apache.shiro.crypto.AesCipherService;
-import org.apache.shiro.util.ByteSource;
+
+import org.apache.shiro.crypto.cipher.AesCipherService;
+import org.apache.shiro.lang.util.ByteSource;
 
 import java.security.Key;
 
@@ -44,8 +45,6 @@ public byte[] encrypt(Key key, byte[] initialText) {
 
     public byte[] decrypt(Key key, byte[] ciphertext) {
         AesCipherService cipherService = new AesCipherService();
-        ByteSource plainText = cipherService.decrypt(ciphertext, key.getEncoded());
-
-        return plainText.getBytes();
+        return cipherService.decrypt(ciphertext, key.getEncoded()).getClonedBytes();
     }
 }
diff --git a/crypto-shiro/src/test/java/de/dominikschadow/javasecurity/hash/SHA512Test.java b/crypto-shiro/src/test/java/de/dominikschadow/javasecurity/hash/SHA512Test.java
@@ -36,7 +36,7 @@ void givenIdenticalPasswordsWhenComparingHashesReturnsTrue() {
         Assertions.assertAll(
                 () -> assertNotNull(hash.getSalt()),
                 () -> assertNotNull(hash.getBytes()),
-                () -> assertEquals(1000000, hash.getIterations()),
+                () -> assertEquals(50000, hash.getIterations()),
                 () -> assertEquals("SHA-512", hash.getAlgorithmName()),
                 () -> assertTrue(hashMatches)
         );
@@ -52,7 +52,7 @@ void givenNotIdenticalPasswordsWhenComparingHashesReturnsFalse() {
         Assertions.assertAll(
                 () -> assertNotNull(hash.getSalt()),
                 () -> assertNotNull(hash.getBytes()),
-                () -> assertEquals(1000000, hash.getIterations()),
+                () -> assertEquals(50000, hash.getIterations()),
                 () -> assertEquals("SHA-512", hash.getAlgorithmName()),
                 () -> assertFalse(hashMatches)
         );
diff --git a/crypto-shiro/src/test/java/de/dominikschadow/javasecurity/symmetric/AESTest.java b/crypto-shiro/src/test/java/de/dominikschadow/javasecurity/symmetric/AESTest.java
@@ -18,7 +18,7 @@
 package de.dominikschadow.javasecurity.symmetric;
 
 import de.dominikschadow.javasecurity.Keystore;
-import org.apache.shiro.codec.CodecSupport;
+import org.apache.shiro.lang.codec.CodecSupport;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
diff --git a/pom.xml b/pom.xml
@@ -91,7 +91,7 @@
             <dependency>
                 <groupId>org.apache.shiro</groupId>
                 <artifactId>shiro-core</artifactId>
-                <version>1.13.0</version>
+                <version>2.0.1</version>
             </dependency>
 
             <dependency>
