Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Completely remove support for fixed IVs and throw a ConfigurationException if encountered. #679

Closed
kwwall opened this issue Apr 10, 2022 · 1 comment
Closed

Completely remove support for fixed IVs and throw a ConfigurationException if encountered. #679

kwwall opened this issue Apr 10, 2022 · 1 comment
Assignees
@kwwall
Labels
Component-Encryptor Component-SecurityConfiguration
Milestone
2.3

Comments

@kwwall
Copy link
Contributor

kwwall commented Apr 10, 2022

In early 2.0 and 2.1 versions of ESAPI, fixed IVs were supported, but that turned out to be really bad idea. Thus, way back in release 2.2.0.0, this feature was deprecated and if it was used, a prominent warning (which probably everyone ignored) was displayed if you used it (that is, if you had the ESAPI property 'Encryptor.ChooseIVMethod' set to 'fixed'.) Unfortunately, knowing human nature, those who were using it probably just ignored the warning message.

Consequently, it is now time to completely disable it and change ESAPI from just displaying a warning to instead throwing a ConfigurationException.

This issue should actually remove the old code that implemented this.
@kwwall kwwall added this to the 2.3 milestone Apr 10, 2022
@kwwall kwwall self-assigned this Apr 10, 2022
jeremiahjstacey pushed a commit that referenced this issue Apr 11, 2022
@kwwall
Changes to close issue #679 (#680)
a9bdaab 
* Changes to close issue #679

* Updated comment about support for fixed IVs in ESAPI.properties file.
@kwwall
Copy link
Contributor Author

kwwall commented Apr 17, 2022

Closed as per PR #680. This will first appear in the ESAPI 2.3.0.0 release.

@kwwall kwwall closed this as completed Apr 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kwwall kwwall

Labels
Component-Encryptor Component-SecurityConfiguration
Projects
None yet
Milestone
2.3
Development

No branches or pull requests
1 participant
@kwwall