zhouxy108/hutool
1
0
Fork 0
mirror of https://gitee.com/chinabugotech/hutool.git synced 2025-07-21 15:09:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

通过添加系统属性hutool.crypto.decodeHex强制关闭hex识别以解决hex和Base64歧义问题

Browse Source
This commit is contained in:
Looly
2024-02-10 08:37:15 +08:00
parent 6accf8fca0
commit e948273f2d
26 changed files with 169 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
hutool-crypto/src/main/java/org/dromara/hutool/crypto/SecureUtil.java
View File

@@ -12,22 +12,23 @@
package org.dromara.hutool.crypto;
import org.bouncycastle.crypto.AlphabetMapper;
import org.dromara.hutool.core.array.ArrayUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.codec.binary.Base64;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.lang.Validator;
import org.dromara.hutool.core.text.StrUtil;
import org.dromara.hutool.core.util.ByteUtil;
import org.dromara.hutool.core.util.SystemUtil;
import org.dromara.hutool.crypto.asymmetric.AsymmetricAlgorithm;
import org.dromara.hutool.crypto.asymmetric.RSA;
import org.dromara.hutool.crypto.digest.DigestAlgorithm;
import org.dromara.hutool.crypto.digest.Digester;
import org.dromara.hutool.crypto.digest.MD5;
import org.dromara.hutool.crypto.digest.mac.HMac;
import org.dromara.hutool.crypto.digest.mac.HmacAlgorithm;
import org.dromara.hutool.crypto.digest.MD5;
import org.dromara.hutool.crypto.provider.GlobalProviderFactory;
import org.dromara.hutool.crypto.symmetric.*;
import org.bouncycastle.crypto.AlphabetMapper;
import javax.crypto.Cipher;
import javax.crypto.Mac;
@@ -51,6 +52,9 @@ import java.util.Objects;
*/
public class SecureUtil {
/** Hutool自定义系统属性：是否解码Hex字符 issue#I90M9D */
public static String HUTOOL_CRYPTO_DECODE_HEX = "hutool.crypto.decodeHex";
/**
* 生成算法，格式为XXXwithXXX
*
@@ -528,7 +532,11 @@ public class SecureUtil {
if(Objects.isNull(key)){
return null;
}
return Validator.isHex(key) ? HexUtil.decodeHex(key) : Base64.decode(key);
// issue#I90M9D
// 某些特殊字符串会无法区分Hex还是Base64，此处使用系统属性强制关闭Hex解析
final boolean decodeHex = SystemUtil.getBoolean(HUTOOL_CRYPTO_DECODE_HEX, true);
return (decodeHex && Validator.isHex(key)) ? HexUtil.decode(key) : Base64.decode(key);
}
/**

10
hutool-crypto/src/main/java/org/dromara/hutool/crypto/asymmetric/AsymmetricEncryptor.java
View File

@@ -12,7 +12,7 @@
package org.dromara.hutool.crypto.asymmetric;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.codec.binary.Base64;
import org.dromara.hutool.core.io.IORuntimeException;
import org.dromara.hutool.core.io.IoUtil;
@@ -51,7 +51,7 @@ public interface AsymmetricEncryptor {
* @return Hex字符串
*/
default String encryptHex(final byte[] data, final KeyType keyType) {
return HexUtil.encodeHexStr(encrypt(data, keyType));
return HexUtil.encodeStr(encrypt(data, keyType));
}
/**
@@ -98,7 +98,7 @@ public interface AsymmetricEncryptor {
* @since 4.0.1
*/
default String encryptHex(final String data, final KeyType keyType) {
return HexUtil.encodeHexStr(encrypt(data, keyType));
return HexUtil.encodeStr(encrypt(data, keyType));
}
/**
@@ -111,7 +111,7 @@ public interface AsymmetricEncryptor {
* @since 4.0.1
*/
default String encryptHex(final String data, final Charset charset, final KeyType keyType) {
return HexUtil.encodeHexStr(encrypt(data, charset, keyType));
return HexUtil.encodeStr(encrypt(data, charset, keyType));
}
/**
@@ -160,7 +160,7 @@ public interface AsymmetricEncryptor {
* @since 4.0.1
*/
default String encryptHex(final InputStream data, final KeyType keyType) {
return HexUtil.encodeHexStr(encrypt(data, keyType));
return HexUtil.encodeStr(encrypt(data, keyType));
}
/**

6
hutool-crypto/src/main/java/org/dromara/hutool/crypto/asymmetric/SM2.java
View File

@@ -27,7 +27,7 @@ import org.bouncycastle.crypto.signers.SM2Signer;
import org.bouncycastle.crypto.signers.StandardDSAEncoding;
import org.bouncycastle.util.BigIntegers;
import org.bouncycastle.util.encoders.Hex;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.lang.Assert;
import org.dromara.hutool.crypto.CryptoException;
import org.dromara.hutool.crypto.SecureUtil;
@@ -347,7 +347,7 @@ public class SM2 extends AbstractAsymmetricCrypto<SM2> {
* @return 签名
*/
public String signHex(final String dataHex, final String idHex) {
return HexUtil.encodeHexStr(sign(HexUtil.decodeHex(dataHex), HexUtil.decodeHex(idHex)));
return HexUtil.encodeStr(sign(HexUtil.decode(dataHex), HexUtil.decode(idHex)));
}
/**
@@ -409,7 +409,7 @@ public class SM2 extends AbstractAsymmetricCrypto<SM2> {
* @since 5.2.0
*/
public boolean verifyHex(final String dataHex, final String signHex, final String idHex) {
return verify(HexUtil.decodeHex(dataHex), HexUtil.decodeHex(signHex), HexUtil.decodeHex(idHex));
return verify(HexUtil.decode(dataHex), HexUtil.decode(signHex), HexUtil.decode(idHex));
}
/**

10
hutool-crypto/src/main/java/org/dromara/hutool/crypto/asymmetric/Sign.java
View File

@@ -12,7 +12,7 @@
package org.dromara.hutool.crypto.asymmetric;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.codec.binary.Base64;
import org.dromara.hutool.core.collection.CollUtil;
import org.dromara.hutool.core.io.IoUtil;
@@ -229,7 +229,7 @@ public class Sign extends BaseAsymmetric<Sign> {
* @since 5.7.0
*/
public String signHex(final String data, final Charset charset) {
return HexUtil.encodeHexStr(sign(data, charset));
return HexUtil.encodeStr(sign(data, charset));
}
/**
@@ -261,7 +261,7 @@ public class Sign extends BaseAsymmetric<Sign> {
* @since 5.7.0
*/
public String signHex(final byte[] data) {
return HexUtil.encodeHexStr(sign(data));
return HexUtil.encodeStr(sign(data));
}
/**
@@ -273,7 +273,7 @@ public class Sign extends BaseAsymmetric<Sign> {
* @since 5.7.0
*/
public String signHex(final InputStream data) {
return HexUtil.encodeHexStr(sign(data));
return HexUtil.encodeStr(sign(data));
}
/**
@@ -297,7 +297,7 @@ public class Sign extends BaseAsymmetric<Sign> {
* @since 5.7.0
*/
public String digestHex(final InputStream data, final int bufferLength) {
return HexUtil.encodeHexStr(sign(data, bufferLength));
return HexUtil.encodeStr(sign(data, bufferLength));
}
/**

12
hutool-crypto/src/main/java/org/dromara/hutool/crypto/digest/Digester.java
View File

@@ -13,7 +13,7 @@
package org.dromara.hutool.crypto.digest;
import org.dromara.hutool.core.array.ArrayUtil;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.lang.wrapper.SimpleWrapper;
import org.dromara.hutool.core.io.IORuntimeException;
import org.dromara.hutool.core.io.IoUtil;
@@ -196,7 +196,7 @@ public class Digester extends SimpleWrapper<MessageDigest> implements Serializab
* @since 4.6.0
*/
public String digestHex(final String data, final Charset charset) {
return HexUtil.encodeHexStr(digest(data, charset));
return HexUtil.encodeStr(digest(data, charset));
}
/**
@@ -235,7 +235,7 @@ public class Digester extends SimpleWrapper<MessageDigest> implements Serializab
* @return 摘要
*/
public String digestHex(final File file) {
return HexUtil.encodeHexStr(digest(file));
return HexUtil.encodeStr(digest(file));
}
/**
@@ -274,7 +274,7 @@ public class Digester extends SimpleWrapper<MessageDigest> implements Serializab
* @return 摘要
*/
public String digestHex(final byte[] data) {
return HexUtil.encodeHexStr(digest(data));
return HexUtil.encodeStr(digest(data));
}
/**
@@ -295,7 +295,7 @@ public class Digester extends SimpleWrapper<MessageDigest> implements Serializab
* @return 摘要
*/
public String digestHex(final InputStream data) {
return HexUtil.encodeHexStr(digest(data));
return HexUtil.encodeStr(digest(data));
}
/**
@@ -334,7 +334,7 @@ public class Digester extends SimpleWrapper<MessageDigest> implements Serializab
* @return 摘要
*/
public String digestHex(final InputStream data, final int bufferLength) {
return HexUtil.encodeHexStr(digest(data, bufferLength));
return HexUtil.encodeStr(digest(data, bufferLength));
}
/**

12
hutool-crypto/src/main/java/org/dromara/hutool/crypto/digest/mac/Mac.java
View File

@@ -12,7 +12,7 @@
package org.dromara.hutool.crypto.digest.mac;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.codec.binary.Base64;
import org.dromara.hutool.core.io.IoUtil;
import org.dromara.hutool.core.io.file.FileUtil;
@@ -116,7 +116,7 @@ public class Mac implements Serializable {
* @return 摘要
*/
public String digestHex(final String data, final Charset charset) {
return HexUtil.encodeHexStr(digest(data, charset));
return HexUtil.encodeStr(digest(data, charset));
}
/**
@@ -155,7 +155,7 @@ public class Mac implements Serializable {
* @return 摘要
*/
public String digestHex(final File file) {
return HexUtil.encodeHexStr(digest(file));
return HexUtil.encodeStr(digest(file));
}
/**
@@ -175,7 +175,7 @@ public class Mac implements Serializable {
* @return 摘要
*/
public String digestHex(final byte[] data) {
return HexUtil.encodeHexStr(digest(data));
return HexUtil.encodeStr(digest(data));
}
/**
@@ -196,7 +196,7 @@ public class Mac implements Serializable {
* @return 摘要
*/
public String digestHex(final InputStream data) {
return HexUtil.encodeHexStr(digest(data));
return HexUtil.encodeStr(digest(data));
}
/**
@@ -219,7 +219,7 @@ public class Mac implements Serializable {
* @return 摘要
*/
public String digestHex(final InputStream data, final int bufferLength) {
return HexUtil.encodeHexStr(digest(data, bufferLength));
return HexUtil.encodeStr(digest(data, bufferLength));
}
/**

4
hutool-crypto/src/main/java/org/dromara/hutool/crypto/symmetric/PBKDF2.java
View File

@@ -12,7 +12,7 @@
package org.dromara.hutool.crypto.symmetric;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.crypto.KeyUtil;
import javax.crypto.SecretKey;
@@ -73,6 +73,6 @@ public class PBKDF2 {
* @return 加密后的密码
*/
public String encryptHex(final char[] password, final byte[] salt) {
return HexUtil.encodeHexStr(encrypt(password, salt));
return HexUtil.encodeStr(encrypt(password, salt));
}
}

4
hutool-crypto/src/main/java/org/dromara/hutool/crypto/symmetric/SymmetricCrypto.java
View File

@@ -13,7 +13,7 @@
package org.dromara.hutool.crypto.symmetric;
import org.dromara.hutool.core.array.ArrayUtil;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.io.IORuntimeException;
import org.dromara.hutool.core.io.IoUtil;
import org.dromara.hutool.core.lang.Assert;
@@ -287,7 +287,7 @@ public class SymmetricCrypto implements SymmetricEncryptor, SymmetricDecryptor,
* @since 5.6.8
*/
public String updateHex(final byte[] data) {
return HexUtil.encodeHexStr(update(data));
return HexUtil.encodeStr(update(data));
}
// --------------------------------------------------------------------------------- Encrypt

10
hutool-crypto/src/main/java/org/dromara/hutool/crypto/symmetric/SymmetricEncryptor.java
View File

@@ -12,7 +12,7 @@
package org.dromara.hutool.crypto.symmetric;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.codec.binary.Base64;
import org.dromara.hutool.core.io.IORuntimeException;
import org.dromara.hutool.core.io.IoUtil;
@@ -61,7 +61,7 @@ public interface SymmetricEncryptor {
* @return 加密后的Hex
*/
default String encryptHex(final byte[] data) {
return HexUtil.encodeHexStr(encrypt(data));
return HexUtil.encodeStr(encrypt(data));
}
/**
@@ -93,7 +93,7 @@ public interface SymmetricEncryptor {
* @return 加密后的Hex
*/
default String encryptHex(final String data, final Charset charset) {
return HexUtil.encodeHexStr(encrypt(data, charset));
return HexUtil.encodeStr(encrypt(data, charset));
}
/**
@@ -125,7 +125,7 @@ public interface SymmetricEncryptor {
* @return 加密后的Hex
*/
default String encryptHex(final String data) {
return HexUtil.encodeHexStr(encrypt(data));
return HexUtil.encodeStr(encrypt(data));
}
/**
@@ -156,7 +156,7 @@ public interface SymmetricEncryptor {
* @return 加密后的Hex
*/
default String encryptHex(final InputStream data) {
return HexUtil.encodeHexStr(encrypt(data));
return HexUtil.encodeStr(encrypt(data));
}
/**

6
hutool-crypto/src/test/java/org/dromara/hutool/crypto/asymmetric/RSATest.java
View File

@@ -12,7 +12,7 @@
package org.dromara.hutool.crypto.asymmetric;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.codec.binary.Base64;
import org.dromara.hutool.core.text.StrUtil;
import org.dromara.hutool.core.array.ArrayUtil;
@@ -190,7 +190,7 @@ public class RSATest {
+ "75F36564BA1DABAA20F3B90FD39315C30E68FE8A1803B36C29029B23EB612C06ACF3A34BE815074F5EB5AA3A"//
+ "C0C8832EC42DA725B4E1C38EF4EA1B85904F8B10B2D62EA782B813229F9090E6F7394E42E6F44494BB8";
final byte[] aByte = HexUtil.decodeHex(a);
final byte[] aByte = HexUtil.decode(a);
final byte[] decrypt = rsa.decrypt(aByte, KeyType.PrivateKey);
Assertions.assertEquals("虎头闯杭州,多抬头看天,切勿只管种地", StrUtil.str(decrypt, CharsetUtil.UTF_8));
@@ -212,7 +212,7 @@ public class RSATest {
//jdk原生加密
final Cipher cipher = Cipher.getInstance("RSA/ECB/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
final String result1 = HexUtil.encodeHexStr(cipher.doFinal(finalData));
final String result1 = HexUtil.encodeStr(cipher.doFinal(finalData));
//hutool加密
final RSA rsa = new RSA("RSA/ECB/NoPadding", null, publicKeyStr);

22
hutool-crypto/src/test/java/org/dromara/hutool/crypto/asymmetric/SM2Test.java
View File

@@ -12,7 +12,7 @@
package org.dromara.hutool.crypto.asymmetric;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.codec.binary.Base64;
import org.dromara.hutool.core.text.StrUtil;
import org.dromara.hutool.core.util.ByteUtil;
@@ -53,8 +53,8 @@ public class SM2Test {
// OBJECT IDENTIFIER 1.2.156.10197.1.301
final String OID = "06082A811CCF5501822D";
final KeyPair pair = KeyUtil.generateKeyPair("SM2");
Assertions.assertTrue(HexUtil.encodeHexStr(pair.getPrivate().getEncoded()).toUpperCase().contains(OID));
Assertions.assertTrue(HexUtil.encodeHexStr(pair.getPublic().getEncoded()).toUpperCase().contains(OID));
Assertions.assertTrue(HexUtil.encodeStr(pair.getPrivate().getEncoded()).toUpperCase().contains(OID));
Assertions.assertTrue(HexUtil.encodeStr(pair.getPublic().getEncoded()).toUpperCase().contains(OID));
}
@Test
@@ -140,7 +140,7 @@ public class SM2Test {
final SM2 sm2 = new SM2(null, publicKeyHex);
sm2.usePlainEncoding();
final boolean verify = sm2.verify(dataBytes, HexUtil.decodeHex(signHex));
final boolean verify = sm2.verify(dataBytes, HexUtil.decode(signHex));
Assertions.assertTrue(verify);
}
@@ -161,8 +161,8 @@ public class SM2Test {
final SM2 sm2 = SmUtil.sm2();
final String sign = sm2.signHex(HexUtil.encodeHexStr(content));
final boolean verify = sm2.verifyHex(HexUtil.encodeHexStr(content), sign);
final String sign = sm2.signHex(HexUtil.encodeStr(content));
final boolean verify = sm2.verifyHex(HexUtil.encodeStr(content), sign);
Assertions.assertTrue(verify);
}
@@ -186,8 +186,8 @@ public class SM2Test {
final KeyPair pair = KeyUtil.generateKeyPair("SM2");
final SM2 sm2 = new SM2(//
HexUtil.encodeHexStr(pair.getPrivate().getEncoded()), //
HexUtil.encodeHexStr(pair.getPublic().getEncoded())//
HexUtil.encodeStr(pair.getPrivate().getEncoded()), //
HexUtil.encodeStr(pair.getPublic().getEncoded())//
);
final byte[] sign = sm2.sign(content.getBytes(StandardCharsets.UTF_8));
@@ -200,12 +200,12 @@ public class SM2Test {
final KeyPair pair = KeyUtil.generateKeyPair("SM2");
final PublicKey publicKey = pair.getPublic();
final byte[] data = KeyUtil.encodeECPublicKey(publicKey);
final String encodeHex = HexUtil.encodeHexStr(data);
final String encodeHex = HexUtil.encodeStr(data);
final String encodeB64 = Base64.encode(data);
final PublicKey Hexdecode = KeyUtil.decodeECPoint(encodeHex, SmUtil.SM2_CURVE_NAME);
final PublicKey B64decode = KeyUtil.decodeECPoint(encodeB64, SmUtil.SM2_CURVE_NAME);
Assertions.assertEquals(HexUtil.encodeHexStr(publicKey.getEncoded()), HexUtil.encodeHexStr(Hexdecode.getEncoded()));
Assertions.assertEquals(HexUtil.encodeHexStr(publicKey.getEncoded()), HexUtil.encodeHexStr(B64decode.getEncoded()));
Assertions.assertEquals(HexUtil.encodeStr(publicKey.getEncoded()), HexUtil.encodeStr(Hexdecode.getEncoded()));
Assertions.assertEquals(HexUtil.encodeStr(publicKey.getEncoded()), HexUtil.encodeStr(B64decode.getEncoded()));
}
@Test

12
hutool-crypto/src/test/java/org/dromara/hutool/crypto/symmetric/AESTest.java
View File

@@ -13,7 +13,7 @@
package org.dromara.hutool.crypto.symmetric;
import org.dromara.hutool.core.codec.binary.Base64;
import org.dromara.hutool.core.codec.HexUtil;
import org.dromara.hutool.core.codec.binary.HexUtil;
import org.dromara.hutool.core.util.RandomUtil;
import org.dromara.hutool.crypto.KeyUtil;
import org.dromara.hutool.crypto.Mode;
@@ -77,22 +77,22 @@ public class AESTest {
public void encryptPKCS7Test2() {
// 构建
final AES aes = new AES(Mode.ECB.name(), "pkcs7padding",
HexUtil.decodeHex("0102030405060708090a0b0c0d0e0f10"));
HexUtil.decode("0102030405060708090a0b0c0d0e0f10"));
// ------------------------------------------------------------------------
// 加密数据为16进制字符串
final String encryptHex = aes.encryptHex(HexUtil.decodeHex("16c5"));
final String encryptHex = aes.encryptHex(HexUtil.decode("16c5"));
// 加密后的Hex
Assertions.assertEquals("25869eb3ff227d9e34b3512d3c3c92ed", encryptHex);
// 加密数据为16进制字符串
final String encryptHex2 = aes.encryptBase64(HexUtil.decodeHex("16c5"));
final String encryptHex2 = aes.encryptBase64(HexUtil.decode("16c5"));
// 加密后的Base64
Assertions.assertEquals("JYaes/8ifZ40s1EtPDyS7Q==", encryptHex2);
// 解密
Assertions.assertEquals("16c5", HexUtil.encodeHexStr(aes.decrypt("25869eb3ff227d9e34b3512d3c3c92ed")));
Assertions.assertEquals("16c5", HexUtil.encodeHexStr(aes.decrypt(HexUtil.encodeHexStr(Base64.decode("JYaes/8ifZ40s1EtPDyS7Q==")))));
Assertions.assertEquals("16c5", HexUtil.encodeStr(aes.decrypt("25869eb3ff227d9e34b3512d3c3c92ed")));
Assertions.assertEquals("16c5", HexUtil.encodeStr(aes.decrypt(HexUtil.encodeStr(Base64.decode("JYaes/8ifZ40s1EtPDyS7Q==")))));
// ------------------------------------------------------------------------
// ------------------------------------------------------------------------