[
https://issues.apache.org/jira/browse/CODEC-310?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17770242#comment-17770242
]
Gary D. Gregory commented on CODEC-310:
---------------------------------------
Patch applied. TY [~yakovsh]!
> Documentation update for the org.apache.commons.codec.digest.* package
> ----------------------------------------------------------------------
>
> Key: CODEC-310
> URL: https://issues.apache.org/jira/browse/CODEC-310
> Project: Commons Codec
> Issue Type: Improvement
> Affects Versions: 1.16
> Reporter: Yakov Shafranovich
> Priority: Minor
> Fix For: 1.16.1
>
>
> The Javadocs for classes in the
> {color:#000000}org.apache.commons.codec.digest.* package reference the use of
> ThreadLocalRandom for salt generation (specifically Crypt, Md5Crypt and
> Sha2Crypt classes). However, looking at the source code, the salt generation
> is happening the in the B64.java class which uses SecureRandom - on line 79:
> {color}
> {color:#000000}[https://github.com/apache/commons-codec/blob/master/src/main/java/org/apache/commons/codec/digest/B64.java#L79]{color}
> Additionally, the documentation doesn't list any of these under digest
> classes:
> [https://commons.apache.org/proper/commons-codec/userguide.html]
> I am providing a PR that does the following:
> * Documents that SecureRandom is used by changing Javadocs in these classes
> * Changes salt generation in UnixCrypt to use SecureRandom to match the
> other classes
> * Update the userguide to list all functions from the digest package
> * Changes the hyperlinks in the user guide from HTTP to HTTPS
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
