CVE-2022-1848 (published 2022-05-24T13:15Z)

Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/erudika/para
commit_details: repo_url: https://github.com/erudika/para
author: Alex Bogdanovski
author_date: 2022-05-23 17:51:21+03:00
msg: fixed password length issues
repository: repo_url: https://github.com/erudika/para
repo_name: Erudika/para
description: Multitenant backend server for building web and mobile apps rapidly. The backend for busy developers. (self-hosted or hosted)
repo_language: Java
owner: erudika
file_changes: filename: User.java
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,6 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Objects;
-import javax.validation.constraints.Max;
 import javax.validation.constraints.NotBlank;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
@@ -80,7 +79,7 @@ public class User implements ParaObject {
 	@Stored private String idpAccessToken;
 	@Stored private String idpRefreshToken;
 
-	private transient @Max(MAX_PASSWORD_LENGTH) String password;
+	private transient String password;
 
 	/**
 	 * No-args constructor.

programming_language: Java
filename: ValidationUtils.java
change_type: ModificationType.MODIFY
diff: @@ -60,6 +60,7 @@ import javax.validation.constraints.Past;
 import javax.validation.constraints.Pattern;
 import javax.validation.constraints.Size;
 import org.apache.commons.beanutils.PropertyUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.math.NumberUtils;
 import org.hibernate.validator.constraints.URL;
 import org.slf4j.Logger;
@@ -125,6 +126,9 @@ public final class ValidationUtils {
 				String prop = "'".concat(constraintViolation.getPropertyPath().toString()).concat("'");
 				list.add(prop.concat(" ").concat(constraintViolation.getMessage()));
 			}
+			if (content instanceof User && StringUtils.length(((User) content).getPassword()) > User.MAX_PASSWORD_LENGTH) {
+				list.add(Utils.formatMessage("{0} must not be longer than {1}.", Config._PASSWORD, User.MAX_PASSWORD_LENGTH));
+			}
 		} catch (Exception e) {
 			logger.error(null, e);
 		}

programming_language: Java
filename: ValidationUtilsTest.java
change_type: ModificationType.MODIFY
diff: @@ -17,13 +17,12 @@
  */
 package com.erudika.para.core.utils;
 
-import com.erudika.para.core.utils.Config;
 import com.erudika.para.core.App;
 import com.erudika.para.core.Sysprop;
 import com.erudika.para.core.Tag;
 import com.erudika.para.core.User;
-import static com.erudika.para.core.validation.ValidationUtils.*;
 import static com.erudika.para.core.validation.Constraint.*;
+import static com.erudika.para.core.validation.ValidationUtils.*;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -228,6 +227,68 @@ public class ValidationUtilsTest {
 		assertTrue(validateObject(app, s1).length == 0);
 	}
 
+	@Test
+	public void testPasswordConstraint() {
+		User u = new User();
+		u.setName("test");
+		u.setEmail("ab@cd.com");
+		u.setIdentifier("ab@cd.com");
+		assertTrue(validateObject(u).length == 0);
+		u.setPassword("T123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345670"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "78912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678"
+				+ "91234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891"
+				+ "23456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123"
+				+ "45678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345"
+				+ "67891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567"
+				+ "89123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
+				+ "12345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912345678912"
+				+ "34567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234"
+				+ "56789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456"
+				+ "789hellohellohellohello");
+		assertFalse(validateObject(u).length == 0);
+	}
+
 	@Test
 	public void testGetCoreValidationConstraints() {
 		assertTrue(getCoreValidationConstraints().containsKey("app"));

programming_language: Java