From 815c0bdecaa29e511ef3f7b6a25fc8cab0a6e61f Mon Sep 17 00:00:00 2001 From: Cody Lerum Date: Mon, 4 Mar 2019 17:15:24 -0700 Subject: [PATCH] move decrypt into the try catch so we handle invalid base 64 Signed-off-by: Cody Lerum --- .../java/com/sun/faces/context/flash/ELFlash.java | 11 ++++++----- .../java/com/sun/faces/util/ByteArrayGuardAESCTR.java | 4 ++-- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/impl/src/main/java/com/sun/faces/context/flash/ELFlash.java b/impl/src/main/java/com/sun/faces/context/flash/ELFlash.java index 1902b06d44..e4154cc336 100644 --- a/impl/src/main/java/com/sun/faces/context/flash/ELFlash.java +++ b/impl/src/main/java/com/sun/faces/context/flash/ELFlash.java @@ -1379,7 +1379,7 @@ void decode(FacesContext context, ELFlash flash, Cookie cookie) throws InvalidKe String temp; String value; - String urlDecodedValue = null; + String urlDecodedValue; try { urlDecodedValue = URLDecoder.decode(cookie.getValue(), "UTF-8"); @@ -1387,9 +1387,9 @@ void decode(FacesContext context, ELFlash flash, Cookie cookie) throws InvalidKe urlDecodedValue = cookie.getValue(); } - value = guard.decrypt(urlDecodedValue); - try { + value = guard.decrypt(urlDecodedValue); + int i = value.indexOf("_"); // IMPORTANT: what was "next" when the cookie was @@ -1442,15 +1442,16 @@ void decode(FacesContext context, ELFlash flash, Cookie cookie) throws InvalidKe } nextRequestFlashInfo.setFlashMap(flashMap); } + } catch(InvalidKeyException e) { + throw e; } catch (Throwable t) { context.getAttributes().put(CONSTANTS.ForceSetMaxAgeZero, Boolean.TRUE); if (LOGGER.isLoggable(Level.SEVERE)) { LOGGER.log(Level.SEVERE, "jsf.externalcontext.flash.bad.cookie", - new Object [] { value }); + new Object [] { urlDecodedValue }); } } - } /** diff --git a/impl/src/main/java/com/sun/faces/util/ByteArrayGuardAESCTR.java b/impl/src/main/java/com/sun/faces/util/ByteArrayGuardAESCTR.java index aabfe219bb..b9418352ec 100644 --- a/impl/src/main/java/com/sun/faces/util/ByteArrayGuardAESCTR.java +++ b/impl/src/main/java/com/sun/faces/util/ByteArrayGuardAESCTR.java @@ -126,7 +126,7 @@ public String encrypt(String value) { public String decrypt(String value) throws InvalidKeyException { - byte[] bytes = DatatypeConverter.parseBase64Binary(value);; + byte[] bytes = DatatypeConverter.parseBase64Binary(value); try { byte[] iv = new byte[16]; @@ -214,4 +214,4 @@ private static byte[] concatBytes(byte[] array1, byte[] array2) { return cBytes; } -} \ No newline at end of file +}