CVE-2022-1848: Insufficient Information (NVD-CWE-noinfo)
value: Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2022-05-24T13:15Z
Repository: https://github.com/erudika/para
Language: Java
Files changed: para-core/src/main/java/com/erudika/para/core/User.java, para-core/src/main/java/com/erudika/para/core/validation/ValidationUtils.java, para-server/src/test/java/com/erudika/para/core/utils/ValidationUtilsTest.java
Commit date: 2022-05-23 17:51:21 +0300
Commit message: fixed password length issues

Diff: diff --git a/para-core/src/main/java/com/erudika/para/core/User.java b/para-core/src/main/java/com/erudika/para/core/User.java
index 101e56c7..c494a7e0 100644
--- a/para-core/src/main/java/com/erudika/para/core/User.java
+++ b/para-core/src/main/java/com/erudika/para/core/User.java
@@ -30,11 +30,10 @@ import com.erudika.para.core.utils.Utils;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Objects;
-import javax.validation.constraints.Max;
 import javax.validation.constraints.NotBlank;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -78,11 +77,11 @@ public class User implements ParaObject {
 	@Stored @Locked private String tokenSecret;
 	@Stored private String idpIdToken;
 	@Stored private String idpAccessToken;
 	@Stored private String idpRefreshToken;
 
-	private transient @Max(MAX_PASSWORD_LENGTH) String password;
+	private transient String password;
 
 	/**
 	 * No-args constructor.
 	 */
 	public User() {
diff --git a/para-core/src/main/java/com/erudika/para/core/validation/ValidationUtils.java b/para-core/src/main/java/com/erudika/para/core/validation/ValidationUtils.java
index 10a3dc20..20574e5d 100644
--- a/para-core/src/main/java/com/erudika/para/core/validation/ValidationUtils.java
+++ b/para-core/src/main/java/com/erudika/para/core/validation/ValidationUtils.java
@@ -58,10 +58,11 @@ import javax.validation.constraints.Max;
 import javax.validation.constraints.Min;
 import javax.validation.constraints.Past;
 import javax.validation.constraints.Pattern;
 import javax.validation.constraints.Size;
 import org.apache.commons.beanutils.PropertyUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.math.NumberUtils;
 import org.hibernate.validator.constraints.URL;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -123,10 +124,13 @@ public final class ValidationUtils {
 		try {
 			for (ConstraintViolation<ParaObject> constraintViolation : getValidator().validate(content)) {
 				String prop = "'".concat(constraintViolation.getPropertyPath().toString()).concat("'");
 				list.add(prop.concat(" ").concat(constraintViolation.getMessage()));
 			}
+			if (content instanceof User && StringUtils.length(((User) content).getPassword()) > User.MAX_PASSWORD_LENGTH) {
+				list.add(Utils.formatMessage("{0} must not be longer than {1}.", Config._PASSWORD, User.MAX_PASSWORD_LENGTH));
+			}
 		} catch (Exception e) {
 			logger.error(null, e);
 		}
 		return list.toArray(new String[]{});
 	}
diff --git a/para-server/src/test/java/com/erudika/para/core/utils/ValidationUtilsTest.java b/para-server/src/test/java/com/erudika/para/core/utils/ValidationUtilsTest.java
index 20694d7a..83f4769e 100644
--- a/para-server/src/test/java/com/erudika/para/core/utils/ValidationUtilsTest.java
+++ b/para-server/src/test/java/com/erudika/para/core/utils/ValidationUtilsTest.java
@@ -15,17 +15,16 @@
  *
  * For issues and patches go to: https://github.com/erudika
  */
 package com.erudika.para.core.utils;
 
-import com.erudika.para.core.utils.Config;
 import com.erudika.para.core.App;
 import com.erudika.para.core.Sysprop;
 import com.erudika.para.core.Tag;
 import com.erudika.para.core.User;
-import static com.erudika.para.core.validation.ValidationUtils.*;
 import static com.erudika.para.core.validation.Constraint.*;
+import static com.erudika.para.core.validation.ValidationUtils.*;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.Date;
 import java.util.HashMap;
@@ -226,10 +225,72 @@ public class ValidationUtilsTest {
 		assertFalse(validateObject(app, s1).length == 0);
 		s1.addProperty("url", "http://www.a.com");
 		assertTrue(validateObject(app, s1).length == 0);
 	}
 
+	@Test
+	public void testPasswordConstraint() {
+		User u = new User();
+		u.setName("test");
+		u.setEmail("ab@cd.com");
+		u.setIdentifier("ab@cd.com");
+		assertTrue(validateObject(u).length == 0);
+		u.setPassword("T123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345670"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "789hellohellohellohello");
+		assertFalse(validateObject(u).length == 0);
+	}
+
 	@Test
 	public void testGetCoreValidationConstraints() {
 		assertTrue(getCoreValidationConstraints().containsKey("app"));
 	}
 

Vulnerable code: import javax.validation.constraints.Max;
	private transient @Max(MAX_PASSWORD_LENGTH) String password;
import com.erudika.para.core.utils.Config;
import static com.erudika.para.core.validation.ValidationUtils.*;
Fixed code: 	private transient String password;
import org.apache.commons.lang3.StringUtils;
			if (content instanceof User && StringUtils.length(((User) content).getPassword()) > User.MAX_PASSWORD_LENGTH) {
				list.add(Utils.formatMessage("{0} must not be longer than {1}.", Config._PASSWORD, User.MAX_PASSWORD_LENGTH));
			}
import static com.erudika.para.core.validation.ValidationUtils.*;
	@Test
	public void testPasswordConstraint() {
		User u = new User();
		u.setName("test");
		u.setEmail("ab@cd.com");
		u.setIdentifier("ab@cd.com");
		assertTrue(validateObject(u).length == 0);
		u.setPassword("T123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345670"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "789hellohellohellohello");
		assertFalse(validateObject(u).length == 0);
	}