Skip to content

Use HexFormat instead of custom Hex codec #19641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
therepanic wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Use HexFormat instead of custom Hex codec #19641

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions ...rc/main/java/org/springframework/security/core/token/KeyBasedPersistenceTokenService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,11 @@

import java.security.SecureRandom;
import java.util.Base64;
import java.util.HexFormat;

import org.jspecify.annotations.Nullable;

import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.codec.Utf8;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
Expand Down Expand Up @@ -71,6 +71,7 @@
* </p>
*
* @author Ben Alex
* @author Andrey Litvitski
*
*/
public class KeyBasedPersistenceTokenService implements TokenService, InitializingBean {
Expand Down Expand Up @@ -142,7 +143,7 @@ private String computeKey(String serverSecret, String content) {
private String generatePseudoRandomNumber() {
byte[] randomBytes = new byte[this.pseudoRandomNumberBytes];
this.secureRandom.nextBytes(randomBytes);
return new String(Hex.encode(randomBytes));
return new String(HexFormat.of().formatHex(randomBytes));
}

private String computeServerSecretApplicableAt(long time) {
Expand Down
7 changes: 3 additions & 4 deletions core/src/main/java/org/springframework/security/core/token/Sha512DigestUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,7 @@

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

import org.springframework.security.crypto.codec.Hex;
import java.util.HexFormat;

/**
* Provides SHA512 digest methods.
Expand Down Expand Up @@ -73,7 +72,7 @@ public static byte[] sha(String data) {
* @return SHA digest as a hex string
*/
public static String shaHex(byte[] data) {
return new String(Hex.encode(sha(data)));
return HexFormat.of().formatHex(sha(data));
}

/**
Expand All @@ -82,7 +81,7 @@ public static String shaHex(byte[] data) {
* @return SHA digest as a hex string
*/
public static String shaHex(String data) {
return new String(Hex.encode(sha(data)));
return HexFormat.of().formatHex(sha(data));
Comment on lines -85 to +84

@therepanic therepanic Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previously, the string was created without regard for the string pool, but now the string pool is being used. Perhaps it should be wrapped in new String()?

}

}
66 changes: 0 additions & 66 deletions crypto/src/main/java/org/springframework/security/crypto/codec/Hex.java
View file
Open in desktop

This file was deleted.

4 changes: 2 additions & 2 deletions crypto/src/main/java/org/springframework/security/crypto/encrypt/AesBytesEncryptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
package org.springframework.security.crypto.encrypt;

import java.security.spec.AlgorithmParameterSpec;
import java.util.HexFormat;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
Expand All @@ -27,7 +28,6 @@

import org.jspecify.annotations.Nullable;

import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.keygen.BytesKeyGenerator;
import org.springframework.security.crypto.keygen.KeyGenerators;
import org.springframework.security.crypto.util.EncodingUtils;
Expand Down Expand Up @@ -102,7 +102,7 @@ public AesBytesEncryptor(String password, CharSequence salt, @Nullable BytesKeyG
public AesBytesEncryptor(String password, CharSequence salt, @Nullable BytesKeyGenerator ivGenerator,
CipherAlgorithm alg) {
this(CipherUtils.newSecretKey("PBKDF2WithHmacSHA1",
new PBEKeySpec(password.toCharArray(), Hex.decode(salt), 1024, 256)), ivGenerator, alg);
new PBEKeySpec(password.toCharArray(), HexFormat.of().parseHex(salt), 1024, 256)), ivGenerator, alg);
}

/**
Expand Down
4 changes: 2 additions & 2 deletions crypto/src/main/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@

package org.springframework.security.crypto.encrypt;

import java.util.HexFormat;
import java.util.Objects;

import javax.crypto.Cipher;
Expand All @@ -24,7 +25,6 @@
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;

import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.keygen.BytesKeyGenerator;
import org.springframework.security.crypto.keygen.KeyGenerators;
import org.springframework.security.crypto.util.EncodingUtils;
Expand Down Expand Up @@ -119,7 +119,7 @@ public byte[] decrypt(byte[] encryptedBytes) {

private static SecretKey deriveKey(String password, CharSequence salt) {
return CipherUtils.newSecretKey("PBKDF2WithHmacSHA256",
new PBEKeySpec(password.toCharArray(), Hex.decode(salt), DEFAULT_PBKDF2_ITERATIONS, 256));
new PBEKeySpec(password.toCharArray(), HexFormat.of().parseHex(salt), DEFAULT_PBKDF2_ITERATIONS, 256));
}

/**
Expand Down
4 changes: 2 additions & 2 deletions crypto/src/main/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@

package org.springframework.security.crypto.encrypt;

import java.util.HexFormat;
import java.util.Objects;

import javax.crypto.Cipher;
Expand All @@ -24,7 +25,6 @@
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;

import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.keygen.BytesKeyGenerator;
import org.springframework.security.crypto.keygen.KeyGenerators;
import org.springframework.security.crypto.util.EncodingUtils;
Expand Down Expand Up @@ -126,7 +126,7 @@ public byte[] decrypt(byte[] encryptedBytes) {

private static SecretKey deriveKey(String password, CharSequence salt) {
return CipherUtils.newSecretKey("PBKDF2WithHmacSHA256",
new PBEKeySpec(password.toCharArray(), Hex.decode(salt), DEFAULT_PBKDF2_ITERATIONS, 256));
new PBEKeySpec(password.toCharArray(), HexFormat.of().parseHex(salt), DEFAULT_PBKDF2_ITERATIONS, 256));
}

/**
Expand Down
5 changes: 3 additions & 2 deletions .../main/java/org/springframework/security/crypto/encrypt/BouncyCastleAesBytesEncryptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,12 @@

package org.springframework.security.crypto.encrypt;

import java.util.HexFormat;

import org.bouncycastle.crypto.PBEParametersGenerator;
import org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator;
import org.bouncycastle.crypto.params.KeyParameter;

import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.keygen.BytesKeyGenerator;
import org.springframework.security.crypto.keygen.KeyGenerators;

Expand All @@ -47,7 +48,7 @@ abstract class BouncyCastleAesBytesEncryptor implements BytesEncryptor {
this.ivGenerator = ivGenerator;
PBEParametersGenerator keyGenerator = new PKCS5S2ParametersGenerator();
byte[] pkcs12PasswordBytes = PBEParametersGenerator.PKCS5PasswordToUTF8Bytes(password.toCharArray());
keyGenerator.init(pkcs12PasswordBytes, Hex.decode(salt), 1024);
keyGenerator.init(pkcs12PasswordBytes, HexFormat.of().parseHex(salt), 1024);
this.secretKey = (KeyParameter) keyGenerator.generateDerivedParameters(256);
}

Expand Down
7 changes: 4 additions & 3 deletions ...o/src/main/java/org/springframework/security/crypto/encrypt/HexEncodingTextEncryptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@

package org.springframework.security.crypto.encrypt;

import org.springframework.security.crypto.codec.Hex;
import java.util.HexFormat;

import org.springframework.security.crypto.codec.Utf8;

/**
Expand All @@ -36,12 +37,12 @@ final class HexEncodingTextEncryptor implements TextEncryptor {

@Override
public String encrypt(String text) {
return new String(Hex.encode(this.encryptor.encrypt(Utf8.encode(text))));
return HexFormat.of().formatHex(this.encryptor.encrypt(Utf8.encode(text)));
}

@Override
public String decrypt(String encryptedText) {
return Utf8.decode(this.encryptor.decrypt(Hex.decode(encryptedText)));
return Utf8.decode(this.encryptor.decrypt(HexFormat.of().parseHex(encryptedText)));
}

}
12 changes: 6 additions & 6 deletions crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaSecretEncryptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,12 +25,12 @@
import java.security.PublicKey;
import java.security.interfaces.RSAPublicKey;
import java.util.Base64;
import java.util.HexFormat;

import javax.crypto.Cipher;

import org.jspecify.annotations.Nullable;

import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.keygen.KeyGenerators;

/**
Expand Down Expand Up @@ -138,7 +138,7 @@ public RsaSecretEncryptor(String encoding, PublicKey publicKey, @Nullable Privat
this.privateKey = privateKey;
this.defaultCharset = Charset.forName(DEFAULT_ENCODING);
this.algorithm = algorithm;
this.salt = isHex(salt) ? salt : new String(Hex.encode(salt.getBytes(this.defaultCharset)));
this.salt = isHex(salt) ? salt : HexFormat.of().formatHex(salt.getBytes(this.defaultCharset));
this.gcm = gcm;
}

Expand Down Expand Up @@ -176,8 +176,8 @@ public byte[] decrypt(byte[] encryptedByteArray) {

private static byte[] encrypt(byte[] text, PublicKey key, RsaAlgorithm alg, String salt, boolean gcm) {
byte[] random = KeyGenerators.secureRandom(16).generateKey();
BytesEncryptor aes = gcm ? Encryptors.stronger(new String(Hex.encode(random)), salt)
: Encryptors.standard(new String(Hex.encode(random)), salt);
BytesEncryptor aes = gcm ? Encryptors.stronger(HexFormat.of().formatHex(random), salt)
: Encryptors.standard(HexFormat.of().formatHex(random), salt);
try {
final Cipher cipher = Cipher.getInstance(alg.getJceName());
cipher.init(Cipher.ENCRYPT_MODE, key);
Expand Down Expand Up @@ -218,7 +218,7 @@ private static byte[] decrypt(byte[] text, @Nullable PrivateKey key, RsaAlgorith
input.read(random);
final Cipher cipher = Cipher.getInstance(alg.getJceName());
cipher.init(Cipher.DECRYPT_MODE, key);
String secret = new String(Hex.encode(cipher.doFinal(random)));
String secret = HexFormat.of().formatHex(cipher.doFinal(random));
byte[] buffer = new byte[text.length - random.length - 2];
input.read(buffer);
BytesEncryptor aes = gcm ? Encryptors.stronger(secret, salt) : Encryptors.standard(secret, salt);
Expand All @@ -235,7 +235,7 @@ private static byte[] decrypt(byte[] text, @Nullable PrivateKey key, RsaAlgorith

private static boolean isHex(String input) {
try {
Hex.decode(input);
HexFormat.of().parseHex(input);
return true;
}
catch (Exception ex) {
Expand Down
4 changes: 2 additions & 2 deletions ...c/main/java/org/springframework/security/crypto/keygen/HexEncodingStringKeyGenerator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

package org.springframework.security.crypto.keygen;

import org.springframework.security.crypto.codec.Hex;
import java.util.HexFormat;

/**
* A StringKeyGenerator that generates hex-encoded String keys. Delegates to a
Expand All @@ -34,7 +34,7 @@ final class HexEncodingStringKeyGenerator implements StringKeyGenerator {

@Override
public String generateKey() {
return new String(Hex.encode(this.keyGenerator.generateKey()));
return HexFormat.of().formatHex(this.keyGenerator.generateKey());
}

}
6 changes: 3 additions & 3 deletions ...o/src/main/java/org/springframework/security/crypto/password/AbstractPasswordEncoder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,8 @@
package org.springframework.security.crypto.password;

import java.security.MessageDigest;
import java.util.HexFormat;

import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.keygen.BytesKeyGenerator;
import org.springframework.security.crypto.keygen.KeyGenerators;
import org.springframework.security.crypto.util.EncodingUtils;
Expand All @@ -40,12 +40,12 @@ protected AbstractPasswordEncoder() {
protected String encodeNonNullPassword(String rawPassword) {
byte[] salt = this.saltGenerator.generateKey();
byte[] encoded = encodeAndConcatenate(rawPassword, salt);
return String.valueOf(Hex.encode(encoded));
return String.valueOf(HexFormat.of().formatHex(encoded));
}

@Override
protected boolean matchesNonNull(String rawPassword, String encodedPassword) {
byte[] digested = Hex.decode(encodedPassword);
byte[] digested = HexFormat.of().parseHex(encodedPassword);
byte[] salt = EncodingUtils.subArray(digested, 0, this.saltGenerator.getKeyLength());
return matchesNonNull(digested, encodeAndConcatenate(rawPassword, salt));
}
Expand Down
4 changes: 2 additions & 2 deletions crypto/src/main/java/org/springframework/security/crypto/password/Md4PasswordEncoder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,8 @@
package org.springframework.security.crypto.password;

import java.util.Base64;
import java.util.HexFormat;

import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.codec.Utf8;
import org.springframework.security.crypto.keygen.Base64StringKeyGenerator;
import org.springframework.security.crypto.keygen.StringKeyGenerator;
Expand Down Expand Up @@ -122,7 +122,7 @@ private String encodedNonNullPassword(byte[] digest) {
if (this.encodeHashAsBase64) {
return Utf8.decode(Base64.getEncoder().encode(digest));
}
return new String(Hex.encode(digest));
return HexFormat.of().formatHex(digest);
}

/**
Expand Down
4 changes: 2 additions & 2 deletions .../main/java/org/springframework/security/crypto/password/MessageDigestPasswordEncoder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@

import java.security.MessageDigest;
import java.util.Base64;
import java.util.HexFormat;

import org.springframework.security.crypto.codec.Hex;
import org.springframework.security.crypto.codec.Utf8;
import org.springframework.security.crypto.keygen.Base64StringKeyGenerator;
import org.springframework.security.crypto.keygen.StringKeyGenerator;
Expand Down Expand Up @@ -132,7 +132,7 @@ private String encodedNonNullPassword(byte[] digest) {
if (this.encodeHashAsBase64) {
return Utf8.decode(Base64.getEncoder().encode(digest));
}
return new String(Hex.encode(digest));
return HexFormat.of().formatHex(digest);
}

/**
Expand Down
Loading
Loading