Package edu.internet2.middleware.morphString

Class Morph

java.lang.Object
edu.internet2.middleware.morphString.Morph
public class Morph extends Object

  • Field Details

    • ENCRYPT_KEY

      public static final String ENCRYPT_KEY
      See Also:

    • testMorphKey

      public static String testMorphKey
      if testing, and not relying on morph key being there, use this

  • Method Details

    • main

      public static void main(String[] args)

    • encrypt

      public static String encrypt(String in)
      Parameters:
      in - $objectType$
      Returns:
      String

    • decrypt

      public static String decrypt(String in)
      This will decrypt a string from an external file if a slash is there. Otherwise it will just return the input since it is just what is being looked for
      Parameters:
      in - $objectType$
      Returns:
      String

    • isEncrypted

      public static boolean isEncrypted(String in)
      Determine whether a value looks like a value that Morph.encrypt() produced (i.e. it is already-encrypted ciphertext) as opposed to arbitrary plaintext.

      This used to be tested by simply seeing whether Morph.decrypt() ran without throwing. That is unreliable: Base64.decodeBase64() silently strips every character that is NOT in the Base64 alphabet, so free-form text (for example a SQL query full of spaces, commas and parentheses) can have its remaining letters/digits decode to a byte array whose length happens to be a valid AES block, "decrypt" to garbage, and thereby be misdetected as ciphertext. That caused config values such as a data-provider-query SQL statement to be silently stored encrypted/masked (GRP false positive).

      A real encrypted value is the non-chunked Base64 output of Crypto.encrypt(), so it contains ONLY Base64 alphabet characters (with at most two trailing '=' padding characters) and its length is a multiple of 4. We require that strict shape before we are willing to trust that a successful decrypt means the value was really encrypted.

      Parameters:
      in - candidate value (may be null)
      Returns:
      true only if in is strict Base64 and decrypts to a non-blank string

    • decryptIfFile

      public static String decryptIfFile(String in)
      This will decrypt a string from an external file if a slash is there. Otherwise it will just return the input since it is just what is being looked for
      Parameters:
      in - $objectType$
      Returns:
      String

    • key

      public static String key()
      Returns:
      the key to encrypt/decrypt