Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-09-11 03:39:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid spring-core in password encoder validation

Browse Source 
`spring-core` is an `optional` dependency of `spring-security-crypto`,
so it is not published in the POM and is not guaranteed to be on the
classpath when the module is used standalone.

7.1.0 refactored `AbstractValidatingPasswordEncoder` to use
`org.springframework.util.StringUtils#hasLength`, which causes
`NoClassDefFoundError` on `BCryptPasswordEncoder#matches` (and other
encoders extending it) for standalone users.

Restore the inline null/empty checks the encoder used prior to that
refactor so that the runtime hot path no longer reaches into
`spring-core`.

Closes gh-19317

Signed-off-by: seonwoo_jung <laborlawseon@kap.kr>
This commit is contained in:
seonwoo_jung
2026-06-15 06:10:02 +09:00
committed by Josh Cummings
parent 25c71e28a8
commit 7cc20776c1
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/src/main/java/org/springframework/security/crypto/password/AbstractValidatingPasswordEncoder.java
+2 -3
View File
@@ -19,7 +19,6 @@ package org.springframework.security.crypto.password;
import org.jspecify.annotations.Nullable;
import org.springframework.lang.Contract;
import org.springframework.util.StringUtils;
/**
* An abstract {@link PasswordEncoder} that implementers can use for expecting the
@@ -46,7 +45,7 @@ public abstract class AbstractValidatingPasswordEncoder implements PasswordEncod
@Override
public final boolean matches(@Nullable CharSequence rawPassword, @Nullable String encodedPassword) {
if (!StringUtils.hasLength(rawPassword) || !StringUtils.hasLength(encodedPassword)) {
if (rawPassword == null || rawPassword.isEmpty() || encodedPassword == null || encodedPassword.isEmpty()) {
return false;
}
return matchesNonNull(rawPassword.toString(), encodedPassword);
@@ -56,7 +55,7 @@ public abstract class AbstractValidatingPasswordEncoder implements PasswordEncod
@Override
public final boolean upgradeEncoding(@Nullable String encodedPassword) {
if (!StringUtils.hasLength(encodedPassword)) {
if (encodedPassword == null || encodedPassword.isEmpty()) {
return false;
}
return upgradeEncodingNonNull(encodedPassword);