CVE-2022-1848 (Java, published 2022-05-24T13:15Z)
Description: value: Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/erudika/para
Files changed:
para-core/src/main/java/com/erudika/para/core/User.java
para-core/src/main/java/com/erudika/para/core/validation/ValidationUtils.java
para-server/src/test/java/com/erudika/para/core/utils/ValidationUtilsTest.java
Commit message: fixed password length issues


Vulnerable code:
import javax.validation.constraints.Max;
	private transient @Max(MAX_PASSWORD_LENGTH) String password;
import com.erudika.para.core.utils.Config;
import static com.erudika.para.core.validation.ValidationUtils.*;

Fixed code:
	private transient String password;
import org.apache.commons.lang3.StringUtils;
			if (content instanceof User && StringUtils.length(((User) content).getPassword()) > User.MAX_PASSWORD_LENGTH) {
				list.add(Utils.formatMessage("{0} must not be longer than {1}.", Config._PASSWORD, User.MAX_PASSWORD_LENGTH));
			}
import static com.erudika.para.core.validation.ValidationUtils.*;
	@Test
	public void testPasswordConstraint() {
		User u = new User();
		u.setName("test");
		u.setEmail("ab@cd.com");
		u.setIdentifier("ab@cd.com");
		assertTrue(validateObject(u).length == 0);
		u.setPassword("T123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345670"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
				+ "789hellohellohellohello");
		assertFalse(validateObject(u).length == 0);
	}