Repository: firebase/firebase-admin-java
Pull request #326 (2019-11-01 19:47:56)

Reject rounds=0 for SHA1 hashes
Port of https://github.com/firebase/firebase-admin-node/pull/677


Patch:
diff --git a/src/main/java/com/google/firebase/auth/hash/Md5.java b/src/main/java/com/google/firebase/auth/hash/Md5.java
index f45362a..2abbe55 100644
--- a/src/main/java/com/google/firebase/auth/hash/Md5.java
+++ b/src/main/java/com/google/firebase/auth/hash/Md5.java
@@ -23,7 +23,7 @@ package com.google.firebase.auth.hash;
 public class Md5 extends RepeatableHash {
 
   private Md5(Builder builder) {
-    super("MD5", 0, 120000, builder);
+    super("MD5", 0, 8192, builder);
   }
 
   public static Builder builder() {
diff --git a/src/main/java/com/google/firebase/auth/hash/Sha1.java b/src/main/java/com/google/firebase/auth/hash/Sha1.java
index d14975f..385f431 100644
--- a/src/main/java/com/google/firebase/auth/hash/Sha1.java
+++ b/src/main/java/com/google/firebase/auth/hash/Sha1.java
@@ -23,7 +23,7 @@ package com.google.firebase.auth.hash;
 public class Sha1 extends RepeatableHash {
 
   private Sha1(Builder builder) {
-    super("SHA1", 0, 120000, builder);
+    super("SHA1", 1, 8192, builder);
   }
 
   public static Builder builder() {
diff --git a/src/main/java/com/google/firebase/auth/hash/Sha256.java b/src/main/java/com/google/firebase/auth/hash/Sha256.java
index ecc0e72..f65aee1 100644
--- a/src/main/java/com/google/firebase/auth/hash/Sha256.java
+++ b/src/main/java/com/google/firebase/auth/hash/Sha256.java
@@ -23,7 +23,7 @@ package com.google.firebase.auth.hash;
 public class Sha256 extends RepeatableHash {
 
   private Sha256(Builder builder) {
-    super("SHA256", 0, 120000, builder);
+    super("SHA256", 1, 8192, builder);
   }
 
   public static Builder builder() {
diff --git a/src/main/java/com/google/firebase/auth/hash/Sha512.java b/src/main/java/com/google/firebase/auth/hash/Sha512.java
index 858d16e..e582520 100644
--- a/src/main/java/com/google/firebase/auth/hash/Sha512.java
+++ b/src/main/java/com/google/firebase/auth/hash/Sha512.java
@@ -23,7 +23,7 @@ package com.google.firebase.auth.hash;
 public class Sha512 extends RepeatableHash {
 
   private Sha512(Builder builder) {
-    super("SHA512", 0, 120000, builder);
+    super("SHA512", 1, 8192, builder);
   }
 
   public static Builder builder() {


Test patch:
diff --git a/src/test/java/com/google/firebase/auth/hash/InvalidHashTest.java b/src/test/java/com/google/firebase/auth/hash/InvalidHashTest.java
index aabe444..5186a44 100644
--- a/src/test/java/com/google/firebase/auth/hash/InvalidHashTest.java
+++ b/src/test/java/com/google/firebase/auth/hash/InvalidHashTest.java
@@ -48,17 +48,21 @@ public class InvalidHashTest {
 
   @Test
   public void testInvalidRepeatableHash() {
+    // TODO(rsgowman): Once we can update to Java8, we could just do something like this instead of
+    // having all of the helpers:
+    //     assertThrows(IllegalArgumentException.class, ()-> Md5.builder().setRounds(-1).build());
+
     List<RepeatableHash.Builder> builders = ImmutableList.<RepeatableHash.Builder>builder()
-        .add(Sha512.builder().setRounds(-1))
-        .add(Sha256.builder().setRounds(-1))
-        .add(Sha1.builder().setRounds(-1))
+        .add(Sha512.builder().setRounds(0))
+        .add(Sha256.builder().setRounds(0))
+        .add(Sha1.builder().setRounds(0))
         .add(Md5.builder().setRounds(-1))
         .add(Pbkdf2Sha256.builder().setRounds(-1))
         .add(PbkdfSha1.builder().setRounds(-1))
-        .add(Sha512.builder().setRounds(120001))
-        .add(Sha256.builder().setRounds(120001))
-        .add(Sha1.builder().setRounds(120001))
-        .add(Md5.builder().setRounds(120001))
+        .add(Sha512.builder().setRounds(8193))
+        .add(Sha256.builder().setRounds(8193))
+        .add(Sha1.builder().setRounds(8193))
+        .add(Md5.builder().setRounds(8193))
         .add(Pbkdf2Sha256.builder().setRounds(120001))
         .add(PbkdfSha1.builder().setRounds(120001))
         .build();
@@ -72,6 +76,22 @@ public class InvalidHashTest {
     }
   }
 
+  @Test
+  public void testValidRepeatableHash() {
+    Md5.builder().setRounds(0).build();
+    Md5.builder().setRounds(8192).build();
+    Sha1.builder().setRounds(1).build();
+    Sha1.builder().setRounds(8192).build();
+    Sha256.builder().setRounds(1).build();
+    Sha256.builder().setRounds(8192).build();
+    Sha512.builder().setRounds(1).build();
+    Sha512.builder().setRounds(8192).build();
+    PbkdfSha1.builder().setRounds(0).build();
+    PbkdfSha1.builder().setRounds(120000).build();
+    Pbkdf2Sha256.builder().setRounds(0).build();
+    Pbkdf2Sha256.builder().setRounds(120000).build();
+  }
+
   @Test
   public void testInvalidScrypt() {
     List<Scrypt.Builder> builders = ImmutableList.of(