Build #2,975

Plan branch:
Verifies the integrety of the projects, as builds are executed immediately after a code change was detected. This plan provides no artifiacts (use a nightly build instead).

Build: #2975 was successful Changes by Guus der Kinderen

Stages & jobs

  1. Default Stage

  2. Continuous Integration

Code commits

Openfire (master)

  • Guus der Kinderen

    Guus der Kinderen 7325e1f3f14d5e2ee8ddc23b02265c23c306dbe4

    OF-3257/OF-3258 (code review): Prevent order-dependent failures by resetting the property after each test.

    • xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServerFakeKeyTest.java (version 7325e1f3f14d5e2ee8ddc23b02265c23c306dbe4)
  • Guus der Kinderen

    Guus der Kinderen 55f400f4b1e48da9a26bf0b033be8a5932653817

    OF-3257: Use constant-time comparison for channel binding data in SCRAM-SHA-1(-PLUS) SASL server
    Previously, the comparison of the expected and received channel binding payloads in ScramSha1SaslServer used Arrays.equals, which is not guaranteed to operate in constant time. This could potentially leak information about the channel binding data through timing side-channels.

    This change replaces Arrays.equals with MessageDigest.isEqual, ensuring that the comparison is performed in constant time. This strengthens the implementation against timing attacks, aligns with secure coding best practices, and provides defense-in-depth for sensitive authentication operations.

    • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version 55f400f4b1e48da9a26bf0b033be8a5932653817)
  • Guus der Kinderen

    Guus der Kinderen d8481eb175564f69727192ee303e49fb58a34bbd

    OF-3257/OF-3258 (code review): Spelling: 'nonexisting' -> 'nonexistent'

    • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version d8481eb175564f69727192ee303e49fb58a34bbd)
    • xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServerFakeKeyTest.java (version d8481eb175564f69727192ee303e49fb58a34bbd)
  • Guus der Kinderen

    Guus der Kinderen fe4f4ad6bc7e97947e02ee1e4df7a8655f85392c

    OF-3257: Avoid short-circuiting in SCRAM by introducing deterministic fake keys
    When storedKey or serverKey are missing, generate deterministic fake values derived from a server-side secret and the username. This ensures that authentication follows the same execution path regardless of user existence, reducing susceptibility to timing attacks.

    Includes unit tests to verify determinism and key separation.

    • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version fe4f4ad6bc7e97947e02ee1e4df7a8655f85392c)
    • xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServerFakeKeyTest.java (version fe4f4ad6bc7e97947e02ee1e4df7a8655f85392c)
  • Guus der Kinderen

    Guus der Kinderen d7e92d5a4b0ab130310cf7a9eb50b7be139e7414

    OF-3257/OF-3258: Improve one-time initialization of SERVER_SECRET_NONEXISTENT_USERS
    The previous method for one-time initialization of the SERVER_SECRET_NONEXISTENT_USERS property (which depended on a static initializer block) proved to be fragile.

    In this commit, initialization happens in a getter that should be used instead of directly accessing the property.

    • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version d7e92d5a4b0ab130310cf7a9eb50b7be139e7414)
  • Guus der Kinderen

    Guus der Kinderen 38b2549c1a8753fffcc25dc54300ec0417d94c9b

    OF-3257 (code review): Remove unused imports

    • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version 38b2549c1a8753fffcc25dc54300ec0417d94c9b)
  • Guus der Kinderen

    Guus der Kinderen d9f966f1ade13034d2328eb10dfe0b76a9fe304e

    OF-3257 (code review): Updated reference to JIRA issue in comment.

    • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version d9f966f1ade13034d2328eb10dfe0b76a9fe304e)