Merge tag 'tags/commons-codec-1.12'

Tagging commons-codec-1.12 from RC3

Author: chtompki

README.md

@@ -46,9 +46,9 @@ Apache Commons Codec
 [![Build Status](https://travis-ci.org/apache/commons-codec.svg?branch=trunk)](https://travis-ci.org/apache/commons-codec)
 [![Coverage Status](https://coveralls.io/repos/apache/commons-codec/badge.svg?branch=trunk)](https://coveralls.io/r/apache/commons-codec)
 
-The Apache Commons Codec package contains simple encoder and decoders for
-     various formats such as Base64 and Hexadecimal.  In addition to these
-     widely used encoders and decoders, the codec package also maintains a
+The Apache Commons Codec package contains simple encoder and decoders for
+     various formats such as Base64 and Hexadecimal.  In addition to these
+     widely used encoders and decoders, the codec package also maintains a
      collection of phonetic encoding utilities.
 
 Documentation
@@ -68,7 +68,7 @@ Alternatively you can pull it from the central Maven repositories:
 <dependency>
   <groupId>commons-codec</groupId>
   <artifactId>commons-codec</artifactId>
-  <version>1.11</version>
+  <version>1.12</version>
 </dependency>
 ```
 

RELEASE-NOTES.txt

@@ -1,3 +1,33 @@
+              Apache Commons Codec 1.12 RELEASE NOTES
+
+The Apache Commons Codec team is pleased to announce the commons-codec-1.12 release!
+
+The Apache Commons Codec package contains simple encoder and decoders for
+     various formats such as Base64 and Hexadecimal.  In addition to these
+     widely used encoders and decoders, the codec package also maintains a
+     collection of phonetic encoding utilities.
+
+Changes in this version include:
+
+New features:
+o Add Percent-Encoding Codec (described in RFC3986 and RFC7578)  Issue: CODEC-240. Thanks to Ioannis Sermetziadis.
+o Add SHA-3 methods in DigestUtils  Issue: CODEC-251. Thanks to Gary Gregory.
+
+Fixed Bugs:
+o B64 salt generator: Random -> ThreadLocalRandom  Issue: CODEC-252.
+o Wrong value calculated by Cologne Phonetic if a special character is placed between equal letters  Issue: CODEC-250. Thanks to Alex Volodko.
+o ColognePhoneticTest.testIsEncodeEquals missing assertions  Issue: CODEC-246. Thanks to Oscar Luis Vera Pérez.
+
+Changes:
+o Update from Java 7 to Java 8  Issue: CODEC-253.
+
+
+Have fun!
+-Apache Commons Codec team
+
+
+-------------------------------------------------------------------------------
+
               Apache Commons Codec 1.11 RELEASE NOTES
 
 The Apache Commons Codec team is pleased to announce the commons-codec-1.11-SNAPSHOT release!

pom.xml

@@ -30,7 +30,7 @@ limitations under the License.
   <groupId>commons-codec</groupId>
   <artifactId>commons-codec</artifactId>
   <!-- Remember to update the version in default.properties as well -->
-  <version>1.12-SNAPSHOT</version>
+  <version>1.12</version>
   <name>Apache Commons Codec</name>
   <inceptionYear>2002</inceptionYear>
   <description>
@@ -45,9 +45,9 @@ limitations under the License.
     <url>http://issues.apache.org/jira/browse/CODEC</url>
   </issueManagement>
   <scm>
-    <connection>scm:svn:http://svn.apache.org/repos/asf/commons/proper/codec/trunk</connection>
-    <developerConnection>scm:svn:https://svn.apache.org/repos/asf/commons/proper/codec/trunk</developerConnection>
-    <url>http://svn.apache.org/viewvc/commons/proper/codec/trunk</url>
+    <connection>scm:git:https://gitbox.apache.org/repos/asf?p=commons-codec.git</connection>
+    <developerConnection>scm:git:https://gitbox.apache.org/repos/asf?p=commons-codec.git</developerConnection>
+    <url>https://github.com/apache/commons-codec</url>
   </scm>
   <distributionManagement>
     <site>
@@ -112,6 +112,11 @@ limitations under the License.
       <id>tn</id>
       <email>tn@apache.org</email>
     </developer>
+    <developer>
+      <name>Rob Tompkins</name>
+      <id>chtompki</id>
+      <email>chtompki@apache.org</email>
+    </developer>
   </developers>
   <contributors>
     <contributor>
@@ -223,9 +228,6 @@ limitations under the License.
     <maven.compiler.target>1.7</maven.compiler.target>
     <commons.componentid>codec</commons.componentid>
     <commons.module.name>org.apache.commons.codec</commons.module.name>
-    <commons.release.version>1.12</commons.release.version>
-    <!-- The RC version used in the staging repository URL. -->
-    <commons.rc.version>RC1</commons.rc.version>
     <commons.jira.id>CODEC</commons.jira.id>
     <commons.jira.pid>12310464</commons.jira.pid>
     <!-- Ensure copies work OK (can be removed later when this is in parent POM) -->
@@ -234,6 +236,23 @@ limitations under the License.
     <commons.encoding>UTF-8</commons.encoding>
     <checkstyle.header.file>${basedir}/LICENSE-header.txt</checkstyle.header.file>
     <checkstyle.version>2.17</checkstyle.version>
+
+    <commons.jacoco.version>0.8.3</commons.jacoco.version>
+
+    <!-- generate report even if there are binary incompatible changes -->
+    <commons.japicmp.breakBuildOnBinaryIncompatibleModifications>false</commons.japicmp.breakBuildOnBinaryIncompatibleModifications>
+    <!-- 0.12.0 dies with a NullPointerException -->
+    <commons.japicmp.version>0.13.0</commons.japicmp.version>
+    <japicmp.skip>false</japicmp.skip>
+
+    <!-- Commons Release Plugin -->
+    <commons.bc.version>1.11</commons.bc.version>
+    <commons.rc.version>RC3</commons.rc.version>
+    <commons.release-plugin.version>1.5</commons.release-plugin.version>
+    <commons.release.isDistModule>true</commons.release.isDistModule>
+    <commons.distSvnStagingUrl>scm:svn:https://dist.apache.org/repos/dist/dev/commons/${commons.componentid}</commons.distSvnStagingUrl>
+    <commons.releaseManagerName>Rob Tompkins</commons.releaseManagerName>
+    <commons.releaseManagerKey>B6E73D84EA4FCC47166087253FAAD2CD5ECBB314</commons.releaseManagerKey>
   </properties>
   <build>
     <defaultGoal>clean verify apache-rat:check clirr:check javadoc:javadoc</defaultGoal>
@@ -249,6 +268,13 @@ limitations under the License.
             </ignorePathsToDelete>
           </configuration>
         </plugin>
+        <plugin>
+          <groupId>com.github.siom79.japicmp</groupId>
+          <artifactId>japicmp-maven-plugin</artifactId>
+          <configuration>
+            <skip>false</skip>
+          </configuration>
+        </plugin>
       </plugins>
     </pluginManagement>
     <plugins>

src/changes/changes.xml

@@ -42,8 +42,11 @@ The <action> type attribute can be add,update,fix,remove.
     <author>Apache Commons Developers</author>
   </properties>
   <body>
-    <release version="1.12" date="2019-MM-DD" description="Feature and fix release.">
+
+    <release version="1.12" date="2019-02-04" description="Feature and fix release.">
       <!-- The first attribute below should be the issue id; makes it easier to navigate in the IDE outline -->
+      <action issue="CODEC-253" dev="chtompki" type="update">Update from Java 7 to Java 8</action>
+      <action issue="CODEC-252" dev="chtompki" type="fix">B64 salt generator: Random -> ThreadLocalRandom</action>
       <action issue="CODEC-250" dev="sebb" type="fix" due-to="Alex Volodko">Wrong value calculated by Cologne Phonetic if a special character is placed between equal letters</action>
       <action issue="CODEC-244" dev="ggregory" type="update">Update from Java 6 to Java 7</action>
       <action issue="CODEC-240" dev="ggregory" type="add" due-to="Ioannis Sermetziadis">Add Percent-Encoding Codec (described in RFC3986 and RFC7578)</action>

src/main/java/org/apache/commons/codec/digest/B64.java

@@ -16,7 +16,9 @@
  */
 package org.apache.commons.codec.digest;
 
-import java.util.concurrent.ThreadLocalRandom;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.Random;
 
 /**
  * Base64-like method to convert binary bytes into ASCII chars.
@@ -68,21 +70,34 @@ static void b64from24bit(final byte b2, final byte b1, final byte b0, final int
         }
     }
 
+  /**
+   * Generates a string of random chars from the B64T set.
+   * <p>
+   * The salt is generated with {@link SecureRandom}.
+   * </p>
+   *
+   * @param num Number of chars to generate.
+   * @return a random salt {@link String}.
+   */
+  static String getRandomSalt(final int num) {
+    return getRandomSalt(num, new SecureRandom());
+  }
+
     /**
      * Generates a string of random chars from the B64T set.
      * <p>
-     * The salt is generated with {@link ThreadLocalRandom}.
+     * The salt is generated with the {@link Random} provided.
      * </p>
      *
-     * @param num
-     *            Number of chars to generate.
+     * @param num Number of chars to generate.
+     * @param random an instance of {@link Random}.
+     * @return a random salt {@link String}.
      */
-    static String getRandomSalt(final int num) {
-        final StringBuilder saltString = new StringBuilder(num);
-        final ThreadLocalRandom current = ThreadLocalRandom.current();
-        for (int i = 1; i <= num; i++) {
-            saltString.append(B64T_ARRAY[current.nextInt(B64T_ARRAY.length)]);
-        }
-        return saltString.toString();
+    static String getRandomSalt(final int num, final Random random) {
+      final StringBuilder saltString = new StringBuilder(num);
+      for (int i = 1; i <= num; i++) {
+        saltString.append(B64T_STRING.charAt(random.nextInt(B64T_STRING.length())));
+      }
+      return saltString.toString();
     }
 }

src/main/java/org/apache/commons/codec/digest/Md5Crypt.java

@@ -19,6 +19,7 @@
 import java.security.MessageDigest;
 import java.security.SecureRandom;
 import java.util.Arrays;
+import java.util.Random;
 import java.util.concurrent.ThreadLocalRandom;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -64,8 +65,8 @@ public class Md5Crypt {
     /**
      * See {@link #apr1Crypt(byte[], String)} for details.
      * <p>
-     * A salt is generated for you using {@link ThreadLocalRandom}; for more secure salts consider using
-     * {@link SecureRandom} to generate your own salts and calling {@link #apr1Crypt(byte[], String)}.
+     * A salt is generated for you using {@link SecureRandom}; your own {@link Random} in
+     * {@link #apr1Crypt(byte[], Random)}.
      * </p>
      *
      * @param keyBytes plaintext string to hash.
@@ -77,11 +78,27 @@ public static String apr1Crypt(final byte[] keyBytes) {
         return apr1Crypt(keyBytes, APR1_PREFIX + B64.getRandomSalt(8));
     }
 
+    /**
+     * See {@link #apr1Crypt(byte[], String)} for details.
+     * <p>
+     * A salt is generated for you using the user provided {@link Random}.
+     * </p>
+     *
+     * @param keyBytes plaintext string to hash.
+     * @param random an arbitrary {@link Random} for the user's reason.
+     * @param random the instance of {@link Random} to use for generating the salt. Consider using {@link SecureRandom}
+     *            or {@link ThreadLocalRandom}.
+     * @throws IllegalArgumentException when a {@link java.security.NoSuchAlgorithmException} is caught. *
+     * @see #apr1Crypt(byte[], String)
+     */
+    public static String apr1Crypt(final byte[] keyBytes, final Random random) {
+        return apr1Crypt(keyBytes, APR1_PREFIX + B64.getRandomSalt(8, random));
+    }
+
     /**
      * See {@link #apr1Crypt(String, String)} for details.
      * <p>
-     * A salt is generated for you using {@link ThreadLocalRandom}; for more secure salts consider using
-     * {@link SecureRandom} to generate your own salts.
+     * A salt is generated for you using {@link SecureRandom}
      * </p>
      *
      * @param keyBytes
@@ -164,10 +181,33 @@ public static String md5Crypt(final byte[] keyBytes) {
         return md5Crypt(keyBytes, MD5_PREFIX + B64.getRandomSalt(8));
     }
 
+    /**
+     * Generates a libc6 crypt() compatible "$1$" hash value.
+     * <p>
+     * See {@link #md5Crypt(byte[], String)} for details.
+     *</p>
+     * <p>
+     * A salt is generated for you using the instance of {@link Random} you supply.
+     * </p>
+     * @param keyBytes
+     *            plaintext string to hash.
+     * @param random
+     *            the instance of {@link Random} to use for generating the salt. Consider using {@link SecureRandom}
+     *            or {@link ThreadLocalRandom}.
+     * @return the hash value
+     * @throws IllegalArgumentException
+     *             when a {@link java.security.NoSuchAlgorithmException} is caught.
+     * @see #md5Crypt(byte[], String)
+     */
+    public static String md5Crypt(final byte[] keyBytes, final Random random) {
+        return md5Crypt(keyBytes, MD5_PREFIX + B64.getRandomSalt(8, random));
+    }
+
     /**
      * Generates a libc crypt() compatible "$1$" MD5 based hash value.
      * <p>
-     * See {@link Crypt#crypt(String, String)} for details.
+     * See {@link Crypt#crypt(String, String)} for details. We use {@link SecureRandom} for seed generation by
+     * default.
      * </p>
      *
      * @param keyBytes
@@ -189,7 +229,8 @@ public static String md5Crypt(final byte[] keyBytes, final String salt) {
     /**
      * Generates a libc6 crypt() "$1$" or Apache htpasswd "$apr1$" hash value.
      * <p>
-     * See {@link Crypt#crypt(String, String)} or {@link #apr1Crypt(String, String)} for details.
+     * See {@link Crypt#crypt(String, String)} or {@link #apr1Crypt(String, String)} for details. We use
+     * {@link SecureRandom by default}.
      * </p>
      *
      * @param keyBytes
@@ -207,12 +248,39 @@ public static String md5Crypt(final byte[] keyBytes, final String salt) {
      *             when a {@link java.security.NoSuchAlgorithmException} is caught.
      */
     public static String md5Crypt(final byte[] keyBytes, final String salt, final String prefix) {
+        return md5Crypt(keyBytes, salt, prefix, new SecureRandom());
+    }
+
+    /**
+     * Generates a libc6 crypt() "$1$" or Apache htpasswd "$apr1$" hash value.
+     * <p>
+     * See {@link Crypt#crypt(String, String)} or {@link #apr1Crypt(String, String)} for details.
+     * </p>
+     *
+     * @param keyBytes
+     *            plaintext string to hash.
+     * @param salt
+     *            real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for
+     *            you using {@link ThreadLocalRandom}; for more secure salts consider using {@link SecureRandom} to
+     *            generate your own salts.
+     * @param prefix
+     *            salt prefix
+     * @param random
+     *            the instance of {@link Random} to use for generating the salt. Consider using {@link SecureRandom}
+     *            or {@link ThreadLocalRandom}.
+     * @return the hash value
+     * @throws IllegalArgumentException
+     *             if the salt does not match the allowed pattern
+     * @throws IllegalArgumentException
+     *             when a {@link java.security.NoSuchAlgorithmException} is caught.
+     */
+    public static String md5Crypt(final byte[] keyBytes, final String salt, final String prefix, final Random random) {
         final int keyLen = keyBytes.length;
 
         // Extract the real salt from the given string which can be a complete hash string.
         String saltString;
         if (salt == null) {
-            saltString = B64.getRandomSalt(8);
+            saltString = B64.getRandomSalt(8, random);
         } else {
             final Pattern p = Pattern.compile("^" + prefix.replace("$", "\\$") + "([\\.\\/a-zA-Z0-9]{1,8}).*");
             final Matcher m = p.matcher(salt);