This is an automated email from the ASF dual-hosted git repository.
gongchao pushed a commit to branch message-online
in repository https://gitbox.apache.org/repos/asf/hertzbeat.git
The following commit(s) were added to refs/heads/message-online by this push:
new 80de5ae4e6 [bugfix] fix the collector aes decode with secret error
80de5ae4e6 is described below
commit 80de5ae4e6fc8f1dedb8743f7c7b10b4d766ac1e
Author: tomsun28 <[email protected]>
AuthorDate: Sun Aug 10 16:41:22 2025 +0800
[bugfix] fix the collector aes decode with secret error
Signed-off-by: tomsun28 <[email protected]>
---
.../org/apache/hertzbeat/common/util/AesUtil.java | 8 ++--
.../apache/hertzbeat/common/util/AesUtilTest.java | 2 +-
.../manager/config/ConfigInitializer.java | 48 ++++++++++++----------
3 files changed, 31 insertions(+), 27 deletions(-)
diff --git
a/hertzbeat-common/src/main/java/org/apache/hertzbeat/common/util/AesUtil.java
b/hertzbeat-common/src/main/java/org/apache/hertzbeat/common/util/AesUtil.java
index ae39dfe0b3..fd1279b809 100644
---
a/hertzbeat-common/src/main/java/org/apache/hertzbeat/common/util/AesUtil.java
+++
b/hertzbeat-common/src/main/java/org/apache/hertzbeat/common/util/AesUtil.java
@@ -37,7 +37,7 @@ public final class AesUtil {
* Default encryption key The AES encryption key is 16 bits by default.
* If the AES encryption key is larger than or smaller than 16 bits, an
error message is displayed
*/
- public static final String ENCODE_RULES = "tomSun28HaHaHaHa";
+ public static final String DEFAULT_ENCODE_RULES = "tomSun28HaHaHaHa";
/**
* Default algorithm
@@ -50,7 +50,7 @@ public final class AesUtil {
* Encryption key The AES encryption key is 16 bits.
* If the AES encryption key is larger than 16 bits, an error message is
displayed
*/
- private static String secretKey = ENCODE_RULES;
+ private static String secretKey = DEFAULT_ENCODE_RULES;
private AesUtil() {}
@@ -113,9 +113,9 @@ public final class AesUtil {
byte[] byteDecode = getBytes(content, decryptKey);
return new String(byteDecode, StandardCharsets.UTF_8);
} catch (BadPaddingException e) {
- if (!ENCODE_RULES.equals(decryptKey)) {
+ if (!DEFAULT_ENCODE_RULES.equals(decryptKey)) {
log.warn("There has default encode secret encode content, try
to decode with default secret key");
- return aesDecode(content, ENCODE_RULES);
+ return aesDecode(content, DEFAULT_ENCODE_RULES);
}
log.error("aes decode content error: {}, please config right
common secret key", e.getMessage());
return content;
diff --git
a/hertzbeat-common/src/test/java/org/apache/hertzbeat/common/util/AesUtilTest.java
b/hertzbeat-common/src/test/java/org/apache/hertzbeat/common/util/AesUtilTest.java
index 40ec65cd01..9bff2d915c 100644
---
a/hertzbeat-common/src/test/java/org/apache/hertzbeat/common/util/AesUtilTest.java
+++
b/hertzbeat-common/src/test/java/org/apache/hertzbeat/common/util/AesUtilTest.java
@@ -95,7 +95,7 @@ class AesUtilTest {
// Test with default key
String originalText = "This is a secret message";
// encode use default secret key
- String encryptedText = aesEncode(originalText, AesUtil.ENCODE_RULES);
+ String encryptedText = aesEncode(originalText,
AesUtil.DEFAULT_ENCODE_RULES);
// decode use new secret key
String decryptedText = aesDecode(encryptedText, "newkey1234567890");
// old data can decode with default secret key
diff --git
a/hertzbeat-manager/src/main/java/org/apache/hertzbeat/manager/config/ConfigInitializer.java
b/hertzbeat-manager/src/main/java/org/apache/hertzbeat/manager/config/ConfigInitializer.java
index 129d004ce4..35d48c0fa9 100644
---
a/hertzbeat-manager/src/main/java/org/apache/hertzbeat/manager/config/ConfigInitializer.java
+++
b/hertzbeat-manager/src/main/java/org/apache/hertzbeat/manager/config/ConfigInitializer.java
@@ -20,9 +20,9 @@ package org.apache.hertzbeat.manager.config;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.usthe.sureness.util.JsonWebTokenUtil;
import jakarta.annotation.Resource;
+import java.security.SecureRandom;
import java.text.SimpleDateFormat;
import java.util.Locale;
-import java.util.Random;
import java.util.TimeZone;
import lombok.SneakyThrows;
import org.apache.commons.lang3.StringUtils;
@@ -63,7 +63,7 @@ public class ConfigInitializer implements SmartLifecycle {
@Value("${sureness.jwt.secret:" + DEFAULT_JWT_SECRET + "}")
private String currentJwtSecret;
- @Value("${common.secret:" + AesUtil.ENCODE_RULES + "}")
+ @Value("${common.secret:" + AesUtil.DEFAULT_ENCODE_RULES + "}")
private String currentAesSecret;
@Resource
@@ -114,38 +114,40 @@ public class ConfigInitializer implements SmartLifecycle {
// for template config, flush the template config in db to memory
TemplateConfig templateConfig = templateConfigService.getConfig();
appService.updateCustomTemplateConfig(templateConfig);
- // for system secrets
+ // for system jwt secrets and aes secret
boolean needUpdate = false;
- SystemSecret.SystemSecretBuilder builder = SystemSecret.builder();
+ SystemSecret.SystemSecretBuilder systemSecretBuilder =
SystemSecret.builder();
+ SystemSecret systemSecret = systemSecretService.getConfig();
+ if (systemSecret != null) {
+ systemSecretBuilder.jwtSecret(systemSecret.getJwtSecret());
+ systemSecretBuilder.aesSecret(systemSecret.getAesSecret());
+ }
if (DEFAULT_JWT_SECRET.equals(currentJwtSecret)) {
// use the random jwt secret
- SystemSecret systemSecret = systemSecretService.getConfig();
if (systemSecret == null ||
StringUtils.isBlank(systemSecret.getJwtSecret())) {
currentJwtSecret = randomizeSecret(DEFAULT_JWT_SECRET);
- builder.jwtSecret(currentJwtSecret);
+ systemSecretBuilder.jwtSecret(currentJwtSecret);
needUpdate = true;
} else {
currentJwtSecret = systemSecret.getJwtSecret();
}
}
- // else use the user custom jwt secret
- // set the jwt secret token in util
+ // else use the user custom jwt secret, set the jwt secret token in
util
JsonWebTokenUtil.setDefaultSecretKey(currentJwtSecret);
// Aes secret config
- if (AesUtil.ENCODE_RULES.equals(currentAesSecret)) {
+ if (AesUtil.DEFAULT_ENCODE_RULES.equals(currentAesSecret)) {
// use the random aes secret
- SystemSecret systemSecret = systemSecretService.getConfig();
if (systemSecret == null ||
StringUtils.isBlank(systemSecret.getAesSecret())) {
- currentAesSecret = randomizeSecret(AesUtil.ENCODE_RULES);
- builder.aesSecret(currentAesSecret);
+ currentAesSecret =
randomizeSecret(AesUtil.DEFAULT_ENCODE_RULES);
+ systemSecretBuilder.aesSecret(currentAesSecret);
+ needUpdate = true;
} else {
currentAesSecret = systemSecret.getAesSecret();
}
}
AesUtil.setDefaultSecretKey(currentAesSecret);
if (needUpdate) {
- SystemSecret systemSecret = builder.build();
- systemSecretService.saveConfig(systemSecret);
+ systemSecretService.saveConfig(systemSecretBuilder.build());
}
// init web-app mute config
MuteConfig muteConfig = muteGeneralConfigService.getConfig();
@@ -177,14 +179,16 @@ public class ConfigInitializer implements SmartLifecycle {
}
private String randomizeSecret(String secret) {
- char[] chars = secret.toCharArray();
- Random rand = new Random();
- for (int i = 0; i < chars.length; i++) {
- int index = rand.nextInt(chars.length);
- char temp = chars[i];
- chars[i] = chars[index];
- chars[index] = temp;
+ SecureRandom random = new SecureRandom();
+ StringBuilder sb = new StringBuilder(secret.length());
+ for (int i = 0; i < secret.length(); i++) {
+ char ch;
+ do {
+ int codePoint = random.nextInt('z' - '0' + 1) + '0';
+ ch = (char) codePoint;
+ } while (!Character.isLetterOrDigit(ch));
+ sb.append(ch);
}
- return new String(chars);
+ return sb.toString();
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
