From 88af509e836976b545e071cfe562bf70258c6c70 Mon Sep 17 00:00:00 2001 From: Neil Derraugh Date: Wed, 6 May 2020 11:28:39 -0400 Subject: Fix security issues in SecurityUtil - Removed hard coded key - Specified mode and padding to address risky algorithm Issue-ID: SDC-3017 Signed-off-by: Neil Derraugh Change-Id: I6c21174003fcb5669de49158d8dd6bf9907f50c6 --- .../src/test/java/SecurityUtilTest.java | 49 ---------------------- 1 file changed, 49 deletions(-) delete mode 100644 openecomp-be/backend/openecomp-sdc-security-util/src/test/java/SecurityUtilTest.java (limited to 'openecomp-be/backend/openecomp-sdc-security-util/src/test/java') diff --git a/openecomp-be/backend/openecomp-sdc-security-util/src/test/java/SecurityUtilTest.java b/openecomp-be/backend/openecomp-sdc-security-util/src/test/java/SecurityUtilTest.java deleted file mode 100644 index 938f3c5e92..0000000000 --- a/openecomp-be/backend/openecomp-sdc-security-util/src/test/java/SecurityUtilTest.java +++ /dev/null @@ -1,49 +0,0 @@ -/*- - * ============LICENSE_START======================================================= - * SDC - * ================================================================================ - * Copyright (C) 2019 AT&T Intellectual Property. All rights reserved. - * ================================================================================ - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * ============LICENSE_END========================================================= - */ - -import org.junit.Test; - -import java.util.Base64; -import org.openecomp.sdc.securityutil.SecurityUtil; - -import static org.junit.Assert.assertEquals; -import static org.junit.Assert.assertNotEquals; - -public class SecurityUtilTest { - - @Test - public void encryptDecryptAES128() { - String data = "decrypt SUCCESS!!"; - String encrypted = SecurityUtil.INSTANCE.encrypt(data).left().value(); - assertNotEquals( data, encrypted ); - byte[] decryptMsg = Base64.getDecoder().decode(encrypted); - assertEquals( SecurityUtil.INSTANCE.decrypt( decryptMsg , false ).left().value() ,data ); - assertEquals( SecurityUtil.INSTANCE.decrypt( encrypted.getBytes() , true ).left().value() ,data ); - } - - @Test - public void obfuscateKey() { - String key = "abcdefghij123456"; - String expectedkey = "********ij123456"; - String obfuscated = SecurityUtil.INSTANCE.obfuscateKey( key ); - System.out.println( obfuscated ); - assertEquals( obfuscated , expectedkey ); - } -} -- cgit 1.2.3-korg