I created a "SecureUtils" method which will launch a .bat file to hash a password and return it as a string in Java. This method works very well on its own (with a main() to test it), but as soon as it is called in the webapp by Tomcat, the password is not hashed and I get the string "error"
First, here is my SecureUtils class:
package com.example.webtodolist;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
public class SecureUtils { public static String hash(String operation, int Chars_to_be_deleted) {
ProcessBuilder processBuilder = new ProcessBuilder();
processBuilder.command("cmd.exe", "/c", operation);
String password_encrypted ="error";
try {
Process process = processBuilder.start();
StringBuilder output = new StringBuilder();
BufferedReader reader = new BufferedReader(
new InputStreamReader(process.getInputStream()));
String line;
while ((line = reader.readLine()) != null) {
output.append(line + "\n");
}
int exitVal = process.waitFor();
if (exitVal == 0) {
output.delete(0,Chars_to_be_deleted);
password_encrypted = output.toString();
//System.exit(0);
return password_encrypted;
}
}
catch (IOException e) {
e.printStackTrace();
} catch (InterruptedException e) {
e.printStackTrace();
}
return password_encrypted;
}
public static String encrypt(String password_clear) throws Exception {
String cmd = System.getProperty("user.dir")+"/apache-tomcat/bin/digest.bat -a sha-512 -i 10 -s 8 -h org.apache.catalina.realm.MessageDigestCredentialHandler ";
int Chars_to_be_deleted = password_clear.length()+1;
String operation=cmd+password_clear;
return hash(operation,Chars_to_be_deleted);
}
public static void main(String[] argv) throws Exception {
System.out.println(encrypt("hugo"));
}
}
And when i run this file with the configuration 'Current file, i get my result (which is correct) :
3bf5f46ed747d0bc$10$e07a85579f5c2447f5a1192b121eca6b8e18c4116373f9e44436c52abf8eb578006a8f5eeaf92c9668db0a0cf7405081b12a1eaef780e446cedaf69f63aa5781
Now, with the 'TomCat Configuration profile, when the function is called I always get:
error.
Here my RegisterServlet.java :
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
try {
String username= request.getParameter("inputUsername");
String password = SecureUtils.encrypt(request.getParameter("inputPassword"));
boolean b = userDBUtil.addUser(new User(username,password));
String m;
if (b) m="A new user has been created";
else m="ERROR";
request.setAttribute("message", m);
request.getRequestDispatcher("/register.jsp").forward(request, response);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
I don't think tomcat is running a process in the background.
Do you know how I can use the
org.apache.catalina.realm.MessageDigestCredentialHandler
method to encrypt my passwords with this configuration (context.xml) without a bat file?
<CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler"
algorithm="SHA-512"
iterations="10"
saltLength="8"
/>
Or is it possible to solve this problem by keeping this method ?