somang4819/itsm_ysm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

취약점 조치

Browse Source
This commit is contained in:
KNKIM 2021-12-03 10:14:57 +09:00
parent f05d731861
commit 038c942c15
2 changed files with 32 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/main/java/nlib/cmm/crypto/AriaCrypto.java
View File

@ -40,11 +40,6 @@ public class AriaCrypto {
private static final Logger log = LoggerFactory.getLogger(AriaCrypto.class); private static final Logger log = LoggerFactory.getLogger(AriaCrypto.class);
/**
* 암호처리 시, 기본 키
*/
private static String ARIA_DEFAULT_KEY = NlibProperty.getProperty("crypto.aria.defaultKey");
/** /**
* 기본키를 가지고 암호화한다. * 기본키를 가지고 암호화한다.
* *
@ -73,11 +68,9 @@ public class AriaCrypto {
* @return * @return
*/ */
public static String encodeEgov(String value) { public static String encodeEgov(String value) {
log.info("encode : 암호화에 사용할 키 정보가 없으므로 기본키 정보를 사용합니다 : " + ARIA_DEFAULT_KEY); return encodeEgov(value, NlibProperty.getProperty("crypto.aria.defaultKey"));
return encodeEgov(value, ARIA_DEFAULT_KEY);
} }
/** /**
* 전달받은 key(사용자고유번호 혹은 메일주소 등 salt값)로 Egov 모듈을 사용하여 암호화한다. * 전달받은 key(사용자고유번호 혹은 메일주소 등 salt값)로 Egov 모듈을 사용하여 암호화한다.
* *
@ -137,8 +130,7 @@ public class AriaCrypto {
* @return * @return
*/ */
public static String decodeEgov(String value) { public static String decodeEgov(String value) {
log.info("decode : 복호화에 사용할 키 정보가 없으므로 기본키 정보를 사용합니다 : " + ARIA_DEFAULT_KEY); return decodeEgov(value, NlibProperty.getProperty("crypto.aria.defaultKey"));
return decodeEgov(value, ARIA_DEFAULT_KEY);
} }
/** /**

59
src/main/java/nlib/cmm/crypto/AriaUtil.java
View File

@ -20,7 +20,6 @@ import nlib.cmm.service.NlibProperty;
public class AriaUtil { public class AriaUtil {
private static final Logger log = LoggerFactory.getLogger(AriaUtil.class); private static final Logger log = LoggerFactory.getLogger(AriaUtil.class);
public static final String PRIVATE_KEY = NlibProperty.getProperty("crypto.aria.defaultKey");
public static String ariaEncrypt(String str, String privateKey) public static String ariaEncrypt(String str, String privateKey)
throws InvalidKeyException, UnsupportedEncodingException { throws InvalidKeyException, UnsupportedEncodingException {
@ -62,8 +61,12 @@ public class AriaUtil {
try { try {
int offset = 0; int offset = 0;
int numRead = 0; int numRead = 0;
while (offset < b.length && (numRead=fis.read(b, offset, b.length-offset)) >= 0) { while (offset < b.length && (numRead=fis.read(b, offset, b.length-offset)) >= 0 ) {
offset += numRead; if( (offset + numRead) <= Integer.MAX_VALUE) {
offset += numRead;
} else {
throw new IOException(f.getName() + " too long.");
}
} }
if (offset < b.length) { if (offset < b.length) {
throw new IOException(f.getName()); throw new IOException(f.getName());
@ -84,11 +87,13 @@ public class AriaUtil {
try { try {
fos.write(c); fos.write(c);
} catch (IOException e) { } catch (IOException e) {
log.error(e.toString());
} finally { } finally {
try { try {
fos.close(); fos.close();
} catch (IOException e) {} } catch (IOException e) {
log.error(e.toString());
}
} }
} }
@ -104,11 +109,8 @@ public class AriaUtil {
AriaEngine instance = new AriaEngine(256, privateKey); AriaEngine instance = new AriaEngine(256, privateKey);
c = AriaEngine.hexToByteArray(strHex); c = AriaEngine.hexToByteArray(strHex);
if(c == null) return null;
if(c == null)
{
return null;
}
p = new byte[c.length]; p = new byte[c.length];
instance.decrypt(c, p, p.length); instance.decrypt(c, p, p.length);
@ -131,7 +133,11 @@ public class AriaUtil {
int offset = 0; int offset = 0;
int numRead = 0; int numRead = 0;
while (offset < b.length && (numRead=fis.read(b, offset, b.length-offset)) >= 0) { while (offset < b.length && (numRead=fis.read(b, offset, b.length-offset)) >= 0) {
offset += numRead; if( (offset + numRead) <= Integer.MAX_VALUE) {
offset += numRead;
} else {
throw new IOException(f.getName() + " too long.");
}
} }
if (offset < b.length) { if (offset < b.length) {
throw new IOException(f.getName()); throw new IOException(f.getName());
@ -153,11 +159,13 @@ public class AriaUtil {
try { try {
fos.write(c); fos.write(c);
} catch (IOException e) { } catch (IOException e) {
log.error(e.toString());
} finally { } finally {
try { try {
fos.close(); fos.close();
} catch (IOException e) {} } catch (IOException e) {
log.error(e.toString());
}
} }
} }
@ -179,7 +187,7 @@ public class AriaUtil {
if (strHex==null || strHex.equals("")) return ""; if (strHex==null || strHex.equals("")) return "";
StringBuffer buf = null; StringBuffer buf = null;
try { try {
String privateKey = PRIVATE_KEY; String privateKey = NlibProperty.getProperty("crypto.aria.defaultKey");
byte[] p; byte[] p;
byte[] c; byte[] c;
@ -208,7 +216,7 @@ public class AriaUtil {
public static String ariaEncrypt(String str) public static String ariaEncrypt(String str)
throws InvalidKeyException, UnsupportedEncodingException { throws InvalidKeyException, UnsupportedEncodingException {
if (str==null || str.equals("")) return ""; if (str==null || str.equals("")) return "";
String privateKey = PRIVATE_KEY; String privateKey = NlibProperty.getProperty("crypto.aria.defaultKey");
byte[] p; byte[] p;
byte[] c; byte[] c;
@ -233,7 +241,7 @@ public class AriaUtil {
public static String ariaCharEncrypt(String str, String charset) public static String ariaCharEncrypt(String str, String charset)
throws InvalidKeyException, UnsupportedEncodingException { throws InvalidKeyException, UnsupportedEncodingException {
if (str==null || str.equals("")) return ""; if (str==null || str.equals("")) return "";
String privateKey = PRIVATE_KEY; String privateKey = NlibProperty.getProperty("crypto.aria.defaultKey");
byte[] p; byte[] p;
byte[] c; byte[] c;
AriaEngine instance = new AriaEngine(256, privateKey); AriaEngine instance = new AriaEngine(256, privateKey);
@ -258,8 +266,8 @@ public class AriaUtil {
throws InvalidKeyException, UnsupportedEncodingException { throws InvalidKeyException, UnsupportedEncodingException {
if (str==null || str.equals("")) return ""; if (str==null || str.equals("")) return "";
String privateKey = ""; String privateKey = "";
if(server.equals("regi")) privateKey = PRIVATE_KEY; if(server.equals("regi")) privateKey = NlibProperty.getProperty("crypto.aria.defaultKey");
else privateKey = PRIVATE_KEY; else privateKey = NlibProperty.getProperty("crypto.aria.defaultKey");
byte[] p; byte[] p;
byte[] c; byte[] c;
@ -285,7 +293,7 @@ public class AriaUtil {
public static String ariaCharDecrypt(String strHex, String charset) public static String ariaCharDecrypt(String strHex, String charset)
throws InvalidKeyException, UnsupportedEncodingException { throws InvalidKeyException, UnsupportedEncodingException {
if (strHex==null || strHex.equals("")) return ""; if (strHex==null || strHex.equals("")) return "";
String privateKey = PRIVATE_KEY; String privateKey = NlibProperty.getProperty("crypto.aria.defaultKey");
byte[] p; byte[] p;
byte[] c; byte[] c;
@ -293,10 +301,7 @@ public class AriaUtil {
c = hexToByteArray(strHex); c = hexToByteArray(strHex);
if(c == null) if(c == null) return null;
{
return null;
}
p = new byte[c.length]; p = new byte[c.length];
instance.decrypt(c, p, p.length); instance.decrypt(c, p, p.length);
@ -314,19 +319,15 @@ public class AriaUtil {
throws InvalidKeyException, UnsupportedEncodingException { throws InvalidKeyException, UnsupportedEncodingException {
if (strHex==null || strHex.equals("")) return ""; if (strHex==null || strHex.equals("")) return "";
String privateKey = ""; String privateKey = "";
if(server.equals("regi")) privateKey = PRIVATE_KEY; if(server.equals("regi")) privateKey = NlibProperty.getProperty("crypto.aria.defaultKey");
else privateKey = PRIVATE_KEY; else privateKey = NlibProperty.getProperty("crypto.aria.defaultKey");
byte[] p; byte[] p;
byte[] c; byte[] c;
AriaEngine instance = new AriaEngine(256, privateKey); AriaEngine instance = new AriaEngine(256, privateKey);
c = hexToByteArray(strHex); c = hexToByteArray(strHex);
if(c == null) return null;
if(c == null)
{
return null;
}
p = new byte[c.length]; p = new byte[c.length];
instance.decrypt(c, p, p.length); instance.decrypt(c, p, p.length);