Examples with ServiceApplicationException org.sasanlabs.service.exception.ServiceApplicationException used on opensource projects

Example 11 with ServiceApplicationException

use of org.sasanlabs.service.exception.ServiceApplicationException in project VulnerableApp by SasanLabs.

the class LibBasedJWTGenerator method getBase64EncodedHMACSignedToken.

/**
 * Signs token using provided secretKey based on the provided algorithm. This method only
 * handles signing of token using HS*(Hmac + Sha*) based algorithm <br>
 *
 * <p>Note: This method adds custom java based implementation of HS* algorithm and doesn't use
 * any library like Nimbus+JOSE or JJWT and reason for this is, libraries are having validations
 * related to Key sizes and they doesn't allow weak keys so for signing token using weak keys
 * (for finding vulnerabilities in web applications that are using old implementations or custom
 * implementations) is not possible therefore added this custom implementation for HS*
 * algorithms.
 *
 * <p>
 *
 * @param token
 * @param secretKey
 * @param algorithm
 * @return
 * @throws JWTExtensionValidationException
 * @throws UnsupportedEncodingException
 */
private String getBase64EncodedHMACSignedToken(byte[] token, byte[] secretKey, String algorithm) throws ServiceApplicationException, UnsupportedEncodingException {
    try {
        if (JWTUtils.JWT_HMAC_ALGO_TO_JAVA_ALGORITHM_MAPPING.containsKey(algorithm)) {
            Mac hmacSHA = Mac.getInstance(JWTUtils.JWT_HMAC_ALGO_TO_JAVA_ALGORITHM_MAPPING.get(algorithm));
            SecretKeySpec hmacSecretKey = new SecretKeySpec(secretKey, hmacSHA.getAlgorithm());
            hmacSHA.init(hmacSecretKey);
            byte[] tokenSignature = hmacSHA.doFinal(token);
            String base64EncodedSignature = JWTUtils.getBase64UrlSafeWithoutPaddingEncodedString(tokenSignature);
            return base64EncodedSignature;
        } else {
            throw new ServiceApplicationException(ExceptionStatusCodeEnum.SYSTEM_ERROR, algorithm + " is not a supported HMAC algorithm.");
        }
    } catch (InvalidKeyException | NoSuchAlgorithmException | IOException e) {
        throw new ServiceApplicationException("Exception occurred while Signing token: " + JWTUtils.getString(token), e, ExceptionStatusCodeEnum.SYSTEM_ERROR);
    }
}