Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-23 10:37:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use Utf8#isEqual

Browse Source 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit is contained in:
Josh Cummings
2026-07-02 17:11:26 -06:00
parent 816066ab60
commit 2f572278d4
1 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.java
+8 -14
View File
@@ -16,8 +16,6 @@
package org.springframework.security.oauth2.server.authorization;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Arrays;
import java.util.Collections;
import java.util.LinkedHashMap;
@@ -27,6 +25,7 @@ import java.util.concurrent.ConcurrentHashMap;
import org.jspecify.annotations.Nullable;
import org.springframework.security.crypto.codec.Utf8;
import org.springframework.security.oauth2.core.OAuth2AccessToken;
import org.springframework.security.oauth2.core.OAuth2DeviceCode;
import org.springframework.security.oauth2.core.OAuth2RefreshToken;
@@ -193,43 +192,38 @@ public final class InMemoryOAuth2AuthorizationService implements OAuth2Authoriza
}
private static boolean matchesState(OAuth2Authorization authorization, String token) {
return isEqual(authorization.getAttribute(OAuth2ParameterNames.STATE), token);
return Utf8.isEqual(authorization.getAttribute(OAuth2ParameterNames.STATE), token);
}
private static boolean matchesAuthorizationCode(OAuth2Authorization authorization, String token) {
OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode = authorization
.getToken(OAuth2AuthorizationCode.class);
return authorizationCode != null && isEqual(authorizationCode.getToken().getTokenValue(), token);
return authorizationCode != null && Utf8.isEqual(authorizationCode.getToken().getTokenValue(), token);
}
private static boolean matchesAccessToken(OAuth2Authorization authorization, String token) {
OAuth2Authorization.Token<OAuth2AccessToken> accessToken = authorization.getToken(OAuth2AccessToken.class);
return accessToken != null && isEqual(accessToken.getToken().getTokenValue(), token);
return accessToken != null && Utf8.isEqual(accessToken.getToken().getTokenValue(), token);
}
private static boolean matchesRefreshToken(OAuth2Authorization authorization, String token) {
OAuth2Authorization.Token<OAuth2RefreshToken> refreshToken = authorization.getToken(OAuth2RefreshToken.class);
return refreshToken != null && isEqual(refreshToken.getToken().getTokenValue(), token);
return refreshToken != null && Utf8.isEqual(refreshToken.getToken().getTokenValue(), token);
}
private static boolean matchesIdToken(OAuth2Authorization authorization, String token) {
OAuth2Authorization.Token<OidcIdToken> idToken = authorization.getToken(OidcIdToken.class);
return idToken != null && isEqual(idToken.getToken().getTokenValue(), token);
return idToken != null && Utf8.isEqual(idToken.getToken().getTokenValue(), token);
}
private static boolean matchesDeviceCode(OAuth2Authorization authorization, String token) {
OAuth2Authorization.Token<OAuth2DeviceCode> deviceCode = authorization.getToken(OAuth2DeviceCode.class);
return deviceCode != null && isEqual(deviceCode.getToken().getTokenValue(), token);
return deviceCode != null && Utf8.isEqual(deviceCode.getToken().getTokenValue(), token);
}
private static boolean matchesUserCode(OAuth2Authorization authorization, String token) {
OAuth2Authorization.Token<OAuth2UserCode> userCode = authorization.getToken(OAuth2UserCode.class);
return userCode != null && isEqual(userCode.getToken().getTokenValue(), token);
}
private static boolean isEqual(@Nullable String left, @Nullable String right) {
return left != null && right != null
&& MessageDigest.isEqual(left.getBytes(StandardCharsets.UTF_8), right.getBytes(StandardCharsets.UTF_8));
return userCode != null && Utf8.isEqual(userCode.getToken().getTokenValue(), token);
}
@SuppressWarnings("serial")