| 1 | package org.europa.together.application; | |
| 2 | ||
| 3 | import com.nimbusds.jose.JWSAlgorithm; | |
| 4 | import com.nimbusds.jose.JWSHeader; | |
| 5 | import com.nimbusds.jose.JWSObject; | |
| 6 | import com.nimbusds.jose.JWSSigner; | |
| 7 | import com.nimbusds.jose.JWSVerifier; | |
| 8 | import com.nimbusds.jose.Payload; | |
| 9 | import com.nimbusds.jose.crypto.MACSigner; | |
| 10 | import com.nimbusds.jose.crypto.MACVerifier; | |
| 11 | import com.nimbusds.jwt.JWTClaimsSet; | |
| 12 | import com.nimbusds.jwt.SignedJWT; | |
| 13 | import java.util.Date; | |
| 14 | import java.util.List; | |
| 15 | import org.europa.together.business.ConfigurationDAO; | |
| 16 | import org.europa.together.business.CryptoTools; | |
| 17 | import org.europa.together.business.JsonWebToken; | |
| 18 | import org.europa.together.business.Logger; | |
| 19 | import org.europa.together.domain.ConfigurationDO; | |
| 20 | import org.europa.together.domain.HashAlgorithm; | |
| 21 | import org.europa.together.domain.LogLevel; | |
| 22 | import org.europa.together.exceptions.DAOException; | |
| 23 | import org.europa.together.exceptions.JsonProcessingException; | |
| 24 | import org.europa.together.utils.Constraints; | |
| 25 | import org.europa.together.utils.StringUtils; | |
| 26 | import org.springframework.beans.factory.annotation.Autowired; | |
| 27 | import org.springframework.stereotype.Repository; | |
| 28 | import org.springframework.transaction.annotation.Transactional; | |
| 29 | ||
| 30 | /** | |
| 31 | * Implementation of JSON Web Token. | |
| 32 | */ | |
| 33 | @Repository | |
| 34 | @Transactional | |
| 35 | public class NimbusJwt implements JsonWebToken { | |
| 36 | ||
| 37 | private static final long serialVersionUID = 16L; | |
| 38 | private static final Logger LOGGER = new LogbackLogger(NimbusJwt.class); | |
| 39 | ||
| 40 | private static final int INT_30 = 30; | |
| 41 | ||
| 42 | private String sharedSecret = ""; | |
| 43 | private String issuer = ""; | |
| 44 | private String subject = ""; | |
| 45 | //1000 * 60 * 10 := 10 minutes = 600000 | |
| 46 | private int expieredTime = 0; | |
| 47 | ||
| 48 | @Autowired | |
| 49 | private ConfigurationDAO configurationDAO; | |
| 50 | @Autowired | |
| 51 | private CryptoTools cryptoTools; | |
| 52 | ||
| 53 | /** | |
| 54 | * Constructor. | |
| 55 | * | |
| 56 | * @throws DAOException case of error | |
| 57 | */ | |
| 58 | public NimbusJwt() throws DAOException { | |
| 59 | LOGGER.log("instance class", LogLevel.INFO); | |
| 60 | } | |
| 61 | ||
| 62 | @Override | |
| 63 | public String buildHMAC512SignedJws(final String jsonPayload) | |
| 64 | throws JsonProcessingException { | |
| 65 | String jws = ""; | |
| 66 | try { | |
| 67 |
1
1. buildHMAC512SignedJws : removed call to org/europa/together/application/NimbusJwt::proccessDbConfiguration → KILLED |
proccessDbConfiguration(); |
| 68 | ||
| 69 | JWSSigner signer = new MACSigner(sharedSecret); | |
| 70 | JWSHeader jswHeader = new JWSHeader(JWSAlgorithm.HS512); | |
| 71 | ||
| 72 | Payload payload = new Payload(jsonPayload); | |
| 73 | ||
| 74 | JWSObject jwsObject = new JWSObject(jswHeader, payload); | |
| 75 |
1
1. buildHMAC512SignedJws : removed call to com/nimbusds/jose/JWSObject::sign → KILLED |
jwsObject.sign(signer); |
| 76 | ||
| 77 | jws = jwsObject.serialize(); | |
| 78 | } catch (Exception ex) { | |
| 79 | throw new JsonProcessingException(ex.getClass().getTypeName() | |
| 80 | + " " + ex.getMessage()); | |
| 81 | } | |
| 82 |
1
1. buildHMAC512SignedJws : replaced return value with "" for org/europa/together/application/NimbusJwt::buildHMAC512SignedJws → KILLED |
return jws; |
| 83 | } | |
| 84 | ||
| 85 | @Override | |
| 86 | public String buildHMAC512SignedJwt(final String issuer, final String subject, | |
| 87 | final List<String> audience) | |
| 88 | throws JsonProcessingException { | |
| 89 | String jwt = ""; | |
| 90 | try { | |
| 91 |
1
1. buildHMAC512SignedJwt : removed call to org/europa/together/application/NimbusJwt::proccessDbConfiguration → KILLED |
proccessDbConfiguration(); |
| 92 | ||
| 93 | JWSSigner signer = new MACSigner(sharedSecret); | |
| 94 | JWSHeader jswHeader = new JWSHeader(JWSAlgorithm.HS512); | |
| 95 | ||
| 96 | Date currentTime = new Date(); | |
| 97 | JWTClaimsSet jwtClaims = new JWTClaimsSet.Builder() | |
| 98 | .issuer(issuer) | |
| 99 | .subject(subject) | |
| 100 | .audience(audience) | |
| 101 |
1
1. buildHMAC512SignedJwt : Replaced long addition with subtraction → SURVIVED |
.expirationTime(new Date(new Date().getTime() + expieredTime)) |
| 102 | .notBeforeTime(currentTime) | |
| 103 | .issueTime(currentTime) | |
| 104 | .jwtID(StringUtils.generateUUID()) | |
| 105 | .build(); | |
| 106 | ||
| 107 | SignedJWT signedJWT = new SignedJWT(jswHeader, jwtClaims); | |
| 108 |
1
1. buildHMAC512SignedJwt : removed call to com/nimbusds/jwt/SignedJWT::sign → KILLED |
signedJWT.sign(signer); |
| 109 | jwt = signedJWT.serialize(); | |
| 110 | } catch (Exception ex) { | |
| 111 | throw new JsonProcessingException(ex.getClass().getTypeName() | |
| 112 | + " " + ex.getMessage()); | |
| 113 | } | |
| 114 |
1
1. buildHMAC512SignedJwt : replaced return value with "" for org/europa/together/application/NimbusJwt::buildHMAC512SignedJwt → KILLED |
return jwt; |
| 115 | } | |
| 116 | ||
| 117 | @Override | |
| 118 | public String buildHMAC512SignedJwt(final List<String> audience) | |
| 119 | throws JsonProcessingException { | |
| 120 |
1
1. buildHMAC512SignedJwt : replaced return value with "" for org/europa/together/application/NimbusJwt::buildHMAC512SignedJwt → KILLED |
return this.buildHMAC512SignedJwt(this.issuer, this.subject, audience); |
| 121 | } | |
| 122 | ||
| 123 | @Override | |
| 124 | public String parseHMAC512SingedJws(final String jws) | |
| 125 | throws JsonProcessingException { | |
| 126 | String payload = ""; | |
| 127 | try { | |
| 128 |
1
1. parseHMAC512SingedJws : removed call to org/europa/together/application/NimbusJwt::proccessDbConfiguration → SURVIVED |
proccessDbConfiguration(); |
| 129 | ||
| 130 | JWSObject jwsObject = JWSObject.parse(jws); | |
| 131 | JWSVerifier verifier = new MACVerifier(sharedSecret); | |
| 132 | payload = jwsObject.getPayload().toString(); | |
| 133 | ||
| 134 |
1
1. parseHMAC512SingedJws : negated conditional → KILLED |
if (!jwsObject.verify(verifier)) { |
| 135 | LOGGER.log("JWS is not valid.", LogLevel.ERROR); | |
| 136 | LOGGER.log("\t payload: " + payload, LogLevel.ERROR); | |
| 137 | throw new JsonProcessingException( | |
| 138 | "JWS is not valid. - for security reasons rejected!"); | |
| 139 | } | |
| 140 | ||
| 141 | } catch (Exception ex) { | |
| 142 | throw new JsonProcessingException(ex.getClass().getTypeName() | |
| 143 | + " " + ex.getMessage()); | |
| 144 | } | |
| 145 |
1
1. parseHMAC512SingedJws : replaced return value with "" for org/europa/together/application/NimbusJwt::parseHMAC512SingedJws → KILLED |
return payload; |
| 146 | } | |
| 147 | ||
| 148 | @Override | |
| 149 | public String parseHMAC512SingedJwt(final String jwt) | |
| 150 | throws JsonProcessingException { | |
| 151 | String payload = ""; | |
| 152 | try { | |
| 153 |
1
1. parseHMAC512SingedJwt : removed call to org/europa/together/application/NimbusJwt::proccessDbConfiguration → SURVIVED |
proccessDbConfiguration(); |
| 154 | ||
| 155 | SignedJWT signedJWT = SignedJWT.parse(jwt); | |
| 156 | JWSVerifier verifier = new MACVerifier(sharedSecret); | |
| 157 | payload = signedJWT.getPayload().toString(); | |
| 158 | ||
| 159 | //TODO: extract for validation | |
| 160 |
1
1. parseHMAC512SingedJwt : negated conditional → KILLED |
if (!signedJWT.verify(verifier)) { |
| 161 | LOGGER.log("JWT is not valid.", LogLevel.ERROR); | |
| 162 | LOGGER.log("\t payload: " + payload, LogLevel.ERROR); | |
| 163 | throw new Exception("JWT is not valid. - for security reasons rejected!"); | |
| 164 | } | |
| 165 | ||
| 166 | } catch (Exception ex) { | |
| 167 | throw new JsonProcessingException(ex.getClass().getTypeName() | |
| 168 | + " " + ex.getMessage()); | |
| 169 | } | |
| 170 |
1
1. parseHMAC512SingedJwt : replaced return value with "" for org/europa/together/application/NimbusJwt::parseHMAC512SingedJwt → KILLED |
return payload; |
| 171 | } | |
| 172 | ||
| 173 | //-------------------------------------------------------------------------- | |
| 174 | private void proccessDbConfiguration() throws DAOException { | |
| 175 | List<ConfigurationDO> configurationEntries = configurationDAO | |
| 176 | .getAllConfigurationSetEntries(Constraints.MODULE_NAME, CONFIG_VERSION, CONFIG_SET); | |
| 177 | LOGGER.log("Process JWT Configuration [" + configurationEntries.size() | |
| 178 | + "] (" + configurationEntries.toString() + ")", LogLevel.DEBUG); | |
| 179 | ||
| 180 | for (ConfigurationDO entry : configurationEntries) { | |
| 181 | String value; | |
| 182 |
1
1. proccessDbConfiguration : negated conditional → KILLED |
if (StringUtils.isEmpty(entry.getValue())) { |
| 183 | value = entry.getDefaultValue(); | |
| 184 | } else { | |
| 185 | value = entry.getValue(); | |
| 186 | } | |
| 187 | ||
| 188 | if (entry.getKey() | |
| 189 |
1
1. proccessDbConfiguration : negated conditional → KILLED |
.equals(cryptoTools.calculateHash("json.sharedSecret", |
| 190 | HashAlgorithm.SHA256))) { | |
| 191 | this.sharedSecret = value; | |
| 192 | LOGGER.log("SharedSecret: " + value, LogLevel.DEBUG); | |
| 193 | } else if (entry.getKey() | |
| 194 |
1
1. proccessDbConfiguration : negated conditional → KILLED |
.equals(cryptoTools.calculateHash("json.issuer", |
| 195 | HashAlgorithm.SHA256))) { | |
| 196 | this.issuer = value; | |
| 197 | LOGGER.log("Issuer: " + value, LogLevel.DEBUG); | |
| 198 | } else if (entry.getKey() | |
| 199 |
1
1. proccessDbConfiguration : negated conditional → KILLED |
.equals(cryptoTools.calculateHash("json.subject", |
| 200 | HashAlgorithm.SHA256))) { | |
| 201 | this.subject = value; | |
| 202 | LOGGER.log("Subiject: " + value, LogLevel.DEBUG); | |
| 203 | } else if (entry.getKey() | |
| 204 |
1
1. proccessDbConfiguration : negated conditional → KILLED |
.equals(cryptoTools.calculateHash("json.expiration.time", |
| 205 | HashAlgorithm.SHA256))) { | |
| 206 | this.expieredTime = Integer.parseInt(value); | |
| 207 | LOGGER.log("Timeout: " + value, LogLevel.DEBUG); | |
| 208 | } | |
| 209 | } | |
| 210 | LOGGER.log("Config: \n" | |
| 211 | + "\t SharedSecret: " + this.sharedSecret + "\n" | |
| 212 | + "\t Issuer: " + this.issuer + "\n" | |
| 213 | + "\t Subiject: " + this.subject + "\n" | |
| 214 | + "\t Timeout: " + this.expieredTime, LogLevel.DEBUG); | |
| 215 | } | |
| 216 | ||
| 217 | } | |
Mutations | ||
| 67 |
1.1 |
|
| 75 |
1.1 |
|
| 82 |
1.1 |
|
| 91 |
1.1 |
|
| 101 |
1.1 |
|
| 108 |
1.1 |
|
| 114 |
1.1 |
|
| 120 |
1.1 |
|
| 128 |
1.1 |
|
| 134 |
1.1 |
|
| 145 |
1.1 |
|
| 153 |
1.1 |
|
| 160 |
1.1 |
|
| 170 |
1.1 |
|
| 182 |
1.1 |
|
| 189 |
1.1 |
|
| 194 |
1.1 |
|
| 199 |
1.1 |
|
| 204 |
1.1 |