LPD-43475 Avoid IndexOutOfBoundsException when the encrypted p******d does not have the algorithm prefixed

rafaprax · brianchandotcom · commit 6fdbb052a6e0 · 2025-01-29T22:46:59.000+08:00
diff --git a/portal-kernel/src/com/liferay/portal/kernel/security/pwd/PasswordEncryptor.java b/portal-kernel/src/com/liferay/portal/kernel/security/pwd/PasswordEncryptor.java
@@ -54,8 +54,13 @@ public String encrypt(
 	public default String getEncryptedPasswordAlgorithmSettings(
 		String encryptedPassword) {
 
-		return encryptedPassword.substring(
-			1, encryptedPassword.indexOf(CharPool.CLOSE_CURLY_BRACE));
+		int index = encryptedPassword.indexOf(CharPool.CLOSE_CURLY_BRACE);
+
+		if (index < 0) {
+			return null;
+		}
+
+		return encryptedPassword.substring(1, index);
 	}
 
 }

Original file line number	Diff line number	Diff line change
`@@ -54,8 +54,13 @@ public String encrypt(`
`54`	`54`	`public default String getEncryptedPasswordAlgorithmSettings(`
`55`	`55`	`String encryptedPassword) {`
`56`	`56`
`57`		`- return encryptedPassword.substring(`
`58`		`- 1, encryptedPassword.indexOf(CharPool.CLOSE_CURLY_BRACE));`
	`57`	`+ int index = encryptedPassword.indexOf(CharPool.CLOSE_CURLY_BRACE);`
	`58`	`+`
	`59`	`+ if (index < 0) {`
	`60`	`+ return null;`
	`61`	`+ }`
	`62`	`+`
	`63`	`+ return encryptedPassword.substring(1, index);`
`59`	`64`	`}`
`60`	`65`
`61`	`66`	`}`