Inlägg

package database;

import java.math.BigInteger;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
import java.util.Arrays;
import java.util.Random;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;


public class HashHandling {
	private static final Random RANDOM = new SecureRandom();
	private static final int ITERATIONS = 10000;
	private static final int KEY_LENGTH = 256;
	private static final char[] hexArray = "0123456789ABCDEF".toCharArray();
	private static final byte[] idSalt = getNextSalt();
	
	public static byte[] getNextSalt() {
		byte[] salt = new byte[16];
		RANDOM.nextBytes(salt);
		return salt;
	}
	
	public static byte[] passwordHashing(char[] password, byte[] salt) {
		PBEKeySpec spec = new PBEKeySpec(password, salt, ITERATIONS, KEY_LENGTH);
		Arrays.fill(password, Character.MIN_VALUE);
		
		try {
			SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");

			return skf.generateSecret(spec).getEncoded();

		} catch(NoSuchAlgorithmException | InvalidKeySpecException e) {

			throw new AssertionError("Error whil hashing a password: "+e.getMessage(), e);

		} finally {
			spec.clearPassword();
		}
	}
	
	public static boolean isExpectedPassword(String pw, String expectedHash) {
		return expectedHash.equals(pw);
	}
	
	public static byte[] idHashing(char[] id) {
		return passwordHashing(id, idSalt);
	}
	
	public static String hashToString(byte[] toConvert) {
		char[] hexChars = new char[toConvert.length * 2];
	    for ( int j = 0; j < toConvert.length; j++ ) {
	        int v = toConvert[j] & 0xFF;
	        hexChars[j * 2] = hexArray[v >>> 4];
	        hexChars[j * 2 + 1] = hexArray[v & 0x0F];
	    }
	    return new String(hexChars);
	}
	
	public static byte[] stringToHashByteVal(String toConvert) {
		byte[] b = new byte[toConvert.length() / 2];
	    for (int i = 0; i < b.length; i++) {
	      int index = i * 2;
	      int v = Integer.parseInt(toConvert.substring(index, index + 2), 16);
	      b[i] = (byte) v;
	    }
	    return b;
	}
}

package main;

import database.DatabaseHandler;
import database.HashHandling;
import database.PostTableRow;
import database.UsersTableRow;
import java.math.BigInteger;
import java.sql.Timestamp;
import java.util.ArrayList;
import database.TableRow;

public class Main {
	public static void main(String[] args) throws Exception{
		
		byte[] salt = HashHandling.idHashing(HashHandling.hashToString(HashHandling.getNextSalt()).toCharArray());
		String orgiPw = new String("test");
		byte[] hashPw = HashHandling.passwordHashing(orgiPw.toCharArray(), salt);
		String HashStr = HashHandling.hashToString(hashPw);
		byte[] conBack = HashHandling.stringToHashByteVal(HashStr);
		String conBackStr = HashHandling.hashToString(conBack);
		System.out.println("Orgi string: "+HashStr+" converted string: "+conBackStr);
		
		if(HashStr.equals(conBackStr)) {
			System.out.println("Their the same!");
		}
		
		if(HashHandling.isExpectedPassword(conBackStr, HashStr)) {
			System.out.println("Converter seam to work.");
		} else {
			System.out.println("Failed");
			System.out.println("\t Conback:\t"+conBackStr);
			System.out.println("\t Orgi:   \t"+conBackStr);
		}
	}
}

Orgi string: A6F3EF6B2E7F7C4EF47968F4DF4A0F12E8D316E2C2755FFF7C2B7F4366ACE3F6 converted string: A6F3EF6B2E7F7C4EF47968F4DF4A0F12E8D316E2C2755FFF7C2B7F4366ACE3F6
Their the same!
Converter seam to work.

public static byte[] stringToHashByteVal(String toConvert) {
		byte[] b = new byte[toConvert.length() / 2];
	    for (int i = 0; i < b.length; i++) {
	      int index = i * 2;
	      int v = Integer.parseInt(toConvert.substring(index, index + 2), 16);
	      b[i] = (byte) v;
	    }
	    return b;
	}

package database;

import java.math.BigInteger;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
import java.util.Arrays;
import java.util.Random;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;


public class HashHandling {
	private static final Random RANDOM = new SecureRandom();
	private static final int ITERATIONS = 10000;
	private static final int KEY_LENGTH = 256;
	private static byte[] idSalt = getNextSalt();
	
	public static byte[] getNextSalt() {
		byte[] salt = new byte[16];
		RANDOM.nextBytes(salt);
		return salt;
	}
	
	public static byte[] passwordHashing(char[] password, byte[] salt) {
		PBEKeySpec spec = new PBEKeySpec(password, salt, ITERATIONS, KEY_LENGTH);
		Arrays.fill(password, Character.MIN_VALUE);
		
		try {
			SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");

			return skf.generateSecret(spec).getEncoded();

		} catch(NoSuchAlgorithmException | InvalidKeySpecException e) {

			throw new AssertionError("Error whil hashing a password: "+e.getMessage(), e);

		} finally {
			spec.clearPassword();
		}
	}
	
	public static boolean isExpectedPassword(char[] password, byte[] salt, byte[] expectedHash) {
		byte[] pwdHash = passwordHashing(password, salt);
		Arrays.fill(password, Character.MIN_VALUE);
		
		if(pwdHash.length != expectedHash.length) {
			return false;
		}
		
		for(int i = 0; i < pwdHash.length; i++) {
			
			if(pwdHash[i] != expectedHash[i]) {
				
				return false;
			}
		}
		
		return true;
	}
	
	public static byte[] idHashing(char[] id) {
		return passwordHashing(id, idSalt);
	}
	
	public static String hashToString(byte[] toConvert) {
		return String.format("%064x", new BigInteger(1, toConvert));
	}
	
	public static byte[] stringToHashByteVal(String toConvert) {
		byte[] b = new byte[toConvert.length() / 2];
	    for (int i = 0; i < b.length; i++) {
	      int index = i * 2;
	      int v = Integer.parseInt(toConvert.substring(index, index + 2), 16);
	      b[i] = (byte) v;
	    }
	    return b;
	}
}

package main;

import database.DatabaseHandler;
import database.HashHandling;
import database.PostTableRow;
import database.UsersTableRow;
import java.math.BigInteger;
import java.sql.Timestamp;
import java.util.ArrayList;
import database.TableRow;

public class Main {
	public static void main(String[] args) throws Exception{
		
		byte[] salt = HashHandling.idHashing(HashHandling.hashToString(HashHandling.getNextSalt()).toCharArray());
		String orgiPw = new String("test");
		byte[] hashPw = HashHandling.passwordHashing(orgiPw.toCharArray(), salt);
		String HashStr = HashHandling.hashToString(hashPw);
		byte[] conBack = HashHandling.stringToHashByteVal(HashStr);
		
		if(HashHandling.isExpectedPassword(conBack.toString().toCharArray(), salt, hashPw)) {
			System.out.println("Converter seam to work.");
		} else {
			System.out.println("Failed");
			System.out.println("\t Conback:\t"+conBack.toString());
			System.out.println("\t Orgi:   \t"+hashPw.toString());
		}
	}
}

 /[^a-z0-9+/.test(tmp)

var input = $("#userInput :input");

for(var i = 0; i < input.length; i++){
   if(input[i] && 0 !== input[i].length;
      var tmp = input[i].value;

      if(tmp && (! /[a-z0-9]+/.test(tmp) || tmp.includes("-"))){
         alert("You have used non-supported characters");
         return;
      }
      // Do stuff...
}

public bool isPathCurrentDirOrSubDir(string newUserPath)
{
    var currentPath = Settings.User.CurrentPath; // "/home/users/test/";
    var newPath = cleanUpPath(newUserPath);
    if (newPath.BeginsWith(currentPath))
    {
        return true;
    }
    else
    {
        return false;
    }
}

public void test(){
      string curent = Directory.GetCurrentDirectory();
      string usrPath = getUserPath();
      string path =  Path.combine(current, usrPath);
      if(!isPathCurrentDirOrSubDir(Path.GetFullPath(path)){
           return;
      }
      // do stuff
}

string path = Directory.GetCurrentDirectory();
string userSetPath = "c:\Windows\System32\ftp.exe";
string openPath = Path.Combine(path, userSetPath); // result openPath="c:\Windows\System32\ftp.exe"

string path = Directory.GetCurrentDirectory(); // let's say c:\User\projektUser\project\Folder
string userSetPath = "..\..\..\Path\outside\parent\file.txt";
string openPath = Path.Combine(path, userSetPath); // result openPath="c:\User\Path\outside\parent\file.txt"

void funk(/*args...*/){
   char* p_mem = new char[256];
   /* ...
       some code....
   */
   delete p_mem;
}

voi funk(/*args...*/){
   char* p_mem = new char[256];
   /* ...
       some code....
   */
   delete[] p_mem;
}