CODEC-252: B64 salt generator: Random -> ThreadLocal<SecureRandom>

chtompki · chtompki · commit dd5d7c43d0de · 2019-02-04T07:34:52.000-05:00
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
@@ -44,6 +44,7 @@ The <action> type attribute can be add,update,fix,remove.
   <body>
     <release version="1.12" date="2017-MM-DD" description="Feature and fix release.">
       <!-- The first attribute below should be the issue id; makes it easier to navigate in the IDE outline -->
+      <action issue="CODEC-252" dev="chtompki" type="fix">B64 salt generator: Random -> ThreadLocalRandom</action>
       <action issue="CODEC-250" dev="sebb" type="fix" due-to="Alex Volodko">Wrong value calculated by Cologne Phonetic if a special character is placed between equal letters</action>
       <action issue="CODEC-244" dev="ggregory" type="update">Update from Java 6 to Java 7</action>
       <action issue="CODEC-240" dev="ggregory" type="add" due-to="Ioannis Sermetziadis">Add Percent-Encoding Codec (described in RFC3986 and RFC7578)</action>
diff --git a/src/main/java/org/apache/commons/codec/digest/B64.java b/src/main/java/org/apache/commons/codec/digest/B64.java
@@ -16,6 +16,8 @@
  */
 package org.apache.commons.codec.digest;
 
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
 import java.util.concurrent.ThreadLocalRandom;
 
 /**
@@ -74,9 +76,15 @@ static void b64from24bit(final byte b2, final byte b1, final byte b0, final int
      */
     static String getRandomSalt(final int num) {
         final StringBuilder saltString = new StringBuilder(num);
-        final ThreadLocalRandom current = ThreadLocalRandom.current();
-        for (int i = 1; i <= num; i++) {
-            saltString.append(B64T.charAt(current.nextInt(B64T.length())));
+        ThreadLocal<SecureRandom> secureRandomThreadLocal = new ThreadLocal<SecureRandom>();
+        try {
+            secureRandomThreadLocal.set(SecureRandom.getInstance("SHA1PRNG"));
+            final SecureRandom current = secureRandomThreadLocal.get();
+            for (int i = 1; i <= num; i++) {
+                saltString.append(B64T.charAt(current.nextInt(B64T.length())));
+            }
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException(e);
         }
         return saltString.toString();
     }
