This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit updates password encoders to use a
constant-time comparison method to defend against
timing attacks
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit adds a constant-time equals method,
useful for comparing password hashes or other
sensitive material
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
org.springframework.lang.Nullable is banned by the
bannedNullabilityImports checkstyle rule on this line; the embargoed
commit that introduced this file predates that rule's adoption here.
Switch to org.jspecify.annotations.Nullable to match the rest of the
codebase (already used correctly elsewhere in this same file).
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Previously, ExternalInetAddressMatcher treated a null InetAddress
as external by negating InternalInetAddressMatcher's result.
This commit makes ExternalInetAddressMatcher return false for a
null address, so that neither the internal nor the external
matcher classifies an unknown address as a match.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit updates password encoders to use a
constant-time comparison method to defend against
timing attacks
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit adds a constant-time equals method,
useful for comparing password hashes or other
sensitive material
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit updates InternalInetAddressMatcher to check
InetAddress#isAnyLocalAddress in order to catch
additional IP addresses
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
org.springframework.lang.Nullable is banned by the
bannedNullabilityImports checkstyle rule on this line; the embargoed
commit that introduced this file predates that rule's adoption here.
Switch to org.jspecify.annotations.Nullable to match the rest of the
codebase (already used correctly elsewhere in this same file).
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Previously, ExternalInetAddressMatcher treated a null InetAddress
as external by negating InternalInetAddressMatcher's result.
This commit makes ExternalInetAddressMatcher return false for a
null address, so that neither the internal nor the external
matcher classifies an unknown address as a match.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
dependabot[bot]