Java - Tomcat Does not Launch ProcessBuilder() -- Password encryption

53 Views Asked by At

I created a "SecureUtils" method which will launch a .bat file to hash a password and return it as a string in Java. This method works very well on its own (with a main() to test it), but as soon as it is called in the webapp by Tomcat, the password is not hashed and I get the string "error"

First, here is my SecureUtils class:

package com.example.webtodolist;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;

public class SecureUtils {    public static String hash(String operation, int Chars_to_be_deleted) {
        ProcessBuilder processBuilder = new ProcessBuilder();
        processBuilder.command("cmd.exe", "/c", operation);
        String password_encrypted ="error";
        try {
            Process process = processBuilder.start();
            StringBuilder output = new StringBuilder();
            BufferedReader reader = new BufferedReader(
                    new InputStreamReader(process.getInputStream()));
            String line;
            while ((line = reader.readLine()) != null) {
                output.append(line + "\n");
            }
            int exitVal = process.waitFor();
            if (exitVal == 0) {
                output.delete(0,Chars_to_be_deleted);
                password_encrypted = output.toString();
                //System.exit(0);
                return password_encrypted;
            }
        }
        catch (IOException e) {
            e.printStackTrace();
        } catch (InterruptedException e) {
            e.printStackTrace();
        }
        return password_encrypted;
    }
    
    public static String encrypt(String password_clear) throws Exception {
        String cmd = System.getProperty("user.dir")+"/apache-tomcat/bin/digest.bat -a sha-512 -i 10 -s 8 -h org.apache.catalina.realm.MessageDigestCredentialHandler ";
        int Chars_to_be_deleted = password_clear.length()+1;
        String operation=cmd+password_clear;
        return hash(operation,Chars_to_be_deleted);
    }

    public static void main(String[] argv) throws Exception {
        System.out.println(encrypt("hugo"));
    }
}

And when i run this file with the configuration 'Current file, i get my result (which is correct) :

3bf5f46ed747d0bc$10$e07a85579f5c2447f5a1192b121eca6b8e18c4116373f9e44436c52abf8eb578006a8f5eeaf92c9668db0a0cf7405081b12a1eaef780e446cedaf69f63aa5781

Now, with the 'TomCat Configuration profile, when the function is called I always get: error.
Here my RegisterServlet.java :

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        try {
            String username= request.getParameter("inputUsername");
            String password = SecureUtils.encrypt(request.getParameter("inputPassword"));
            boolean b = userDBUtil.addUser(new User(username,password));
            String m;
            if (b) m="A new user has been created";
            else m="ERROR";
            request.setAttribute("message", m);
            request.getRequestDispatcher("/register.jsp").forward(request, response);
        } catch (Exception e) {
// TODO Auto-generated catch block
            e.printStackTrace();
        }
    }

I don't think tomcat is running a process in the background.

Do you know how I can use the

org.apache.catalina.realm.MessageDigestCredentialHandler

method to encrypt my passwords with this configuration (context.xml) without a bat file?

<CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler"
                   algorithm="SHA-512"
                   iterations="10"
                   saltLength="8"
/>

Or is it possible to solve this problem by keeping this method ?

0

There are 0 best solutions below