1 /*
2  *  Make.org Core API
3  *  Copyright (C) 2018 Make.org
4  *
5  * This program is free software: you can redistribute it and/or modify
6  *  it under the terms of the GNU Affero General Public License as
7  *  published by the Free Software Foundation, either version 3 of the
8  *  License, or (at your option) any later version.
9  *
10  *  This program is distributed in the hope that it will be useful,
11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  *  GNU Affero General Public License for more details.
14  *
15  *  You should have received a copy of the GNU Affero General Public License
16  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
17  *
18  */
19 
20 package org.make.api.technical.security
21 
22 import java.security.MessageDigest
23 import java.util.Base64
24 
25 import grizzled.slf4j.Logging
26 import org.make.core.DateHelper
27 
28 object SecurityHelper extends Logging {
29 
30   val HASH_SEPARATOR: String = "-"
31 
32   @Deprecated
33 //  This hash method is used for backward compatibility only. Use `defaultHash` instead.
34   def sha256(value: String): String =
35     MessageDigest.getInstance("SHA-256").digest(value.getBytes("UTF-8")).map("%02x".format(_)).mkString
36 
37   def defaultHash(value: String): String =
38     MessageDigest.getInstance("SHA-512").digest(value.getBytes("UTF-8")).map("%02x".format(_)).mkString
39 
40   def base64Encode(value: String): String =
41     Base64.getEncoder.encodeToString(value.getBytes("UTF-8"))
42 
43   def base64Decode(value: String): String =
44     new String(Base64.getDecoder.decode(value), "UTF-8")
45 
46   def generateHash(value: String, salt: String): String =
47     defaultHash(s"${defaultHash(value)}$salt")
48 
49   def createSecureHash(value: String, salt: String): String = {
50     val date = DateHelper.now().toString
51 
52     s"${base64Encode(date)}$HASH_SEPARATOR${generateHash(s"$value$date", salt)}"
53   }
54 
55   def validateSecureHash(hash: String, value: String, salt: String): Boolean = {
56     hash.split(HASH_SEPARATOR) match {
57       case Array(base64Date, hashedValue) =>
58         val deprecatedCheck = sha256(s"${sha256(s"$value")}${base64Decode(base64Date)}$salt") == hashedValue
59         if (deprecatedCheck) {
60           logger.warn(s"Use of deprecated hash function (sha256) on value $value")
61         }
62         generateHash(s"$value${base64Decode(base64Date)}", salt) == hashedValue || deprecatedCheck
63       case _ => false
64     }
65   }
66 
67   def anonymizeEmail(email: String): String = {
68     val emailDomainName = email.takeRight(email.length - email.lastIndexOf("@"))
69     val emailLocalPart = email.substring(0, email.lastIndexOf("@"))
70     s"${emailLocalPart.head}${"*" * (emailLocalPart.length - 2)}${emailLocalPart.last}$emailDomainName"
71   }
72 }