etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix security hotspot

This commit is contained in:
nvazquez 2022-08-15 11:43:24 -03:00
parent 681e463f2a
commit 2763218ce1
No known key found for this signature in database
GPG Key ID: 656E1BCC8CB54F84
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
server/src/main/java/com/cloud/consoleproxy/ConsoleAccessManagerImpl.java
View File

@ -369,13 +369,13 @@ public class ConsoleAccessManagerImpl extends ManagerBase implements ConsoleAcce
String params = "host=" + host + "&port=" + port + "&sid=" + sid + "&tag=" + tag + "&session=" + sessionUuid;
try {
Mac mac = Mac.getInstance("HmacSHA1");
Mac mac = Mac.getInstance("SHA-512");
long ts = normalizedHashTime.getTime();
ts = ts / 60000; // round up to 1 minute
String secretKey = s_keysMgr.getHashKey();
SecretKeySpec keySpec = new SecretKeySpec(secretKey.getBytes(), "HmacSHA1");
SecretKeySpec keySpec = new SecretKeySpec(secretKey.getBytes(), mac.getAlgorithm());
mac.init(keySpec);
mac.update(params.getBytes());
mac.update(String.valueOf(ts).getBytes());