Initial commit

.gitignore

+target/
+!.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**/target/
+!**/src/test/**/target/
+
+### IntelliJ IDEA ###
+#.idea/modules.xml
+#.idea/jarRepositories.xml
+#.idea/compiler.xml
+#.idea/libraries/
+.idea/
+*.iws
+*.iml
+*.ipr
+
+### Eclipse ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### VS Code ###
+.vscode/
+
+### Mac OS ###
+.DS_Store
\ No newline at end of file

.gitlab-ci.yml

+variables:
+  # This will suppress any download for dependencies and plugins or upload messages which would clutter the console log.
+  # `showDateTime` will show the passed time in milliseconds. You need to specify `--batch-mode` to make this work.
+  MAVEN_OPTS: "-Dhttps.protocols=TLSv1.2 -Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN -Dorg.slf4j.simpleLogger.showDateTime=true -Djava.awt.headless=true"
+  # As of Maven 3.3.0 instead of this you may define these options in `.mvn/maven.config` so the same config is used
+  # when running from the command line.
+  # `installAtEnd` and `deployAtEnd` are only effective with recent version of the corresponding plugins.
+  MAVEN_CLI_OPTS: "--batch-mode --errors --fail-at-end --show-version -DinstallAtEnd=true -DdeployAtEnd=true"
+
+# Maven avec JDK 22
+image: maven:3-eclipse-temurin-22
+
+# Cache downloaded dependencies and plugins between builds.
+# To keep cache across branches add 'key: "$CI_JOB_NAME"'
+cache:
+  paths:
+    - .m2/repository
+
+stages:
+  - build
+  - test
+
+build:
+  stage: build
+  script:
+    - 'mvn $MAVEN_CLI_OPTS clean'
+    - 'mvn $MAVEN_CLI_OPTS compile'
+
+testing:
+  stage: test
+  script:
+    - 'mvn $MAVEN_CLI_OPTS test'
+
+include:
+  - template: Jobs/Secret-Detection.gitlab-ci.yml

README.md

+# Sécurisation des mots passes
+
+Dépôt pour le TP4 de sécurité des applications.

pom.xml

+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>fr.univ_amu.fr.formation.m1info.secapp</groupId>
+    <artifactId>secure_secret</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <maven.compiler.source>22</maven.compiler.source>
+        <maven.compiler.target>22</maven.compiler.target>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <version>5.11.3</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.github.jopenlibs</groupId>
+            <artifactId>vault-java-driver</artifactId>
+            <version>6.2.0</version>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file

src/main/java/fr/univ_amu/fr/formation/m1info/secapp/HashCheck.java

+package fr.univ_amu.fr.formation.m1info.secapp;
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Base64;
+
+/**
+ * Hash password check
+ */
+public class HashCheck {
+
+    /**
+     * The SHA hash of the password
+     */
+    private final byte[] hashPassword;
+
+    /**
+     * Constructor
+     * @param password the plain password (default to empty string)
+     * @param base64 true if password is already hash and encoded into base64
+     */
+    public HashCheck(String password, boolean base64) {
+        hashPassword = null;
+        // A compléter lors de l'EXERCICE 2
+    }
+
+    /**
+     * Compare password with hash (naive version)
+     * @param password the password to check
+     * @return true if equals false else
+     */
+    public boolean checkPassword(String password) {
+        // A compléter lors de l'EXERCICE 2
+        return false;
+    }
+
+    /**
+     * Build the digest method for computing hash
+     * @return the digest method
+     */
+    private static MessageDigest getDigestMethod () {
+        // A compléter lors de l'EXERCICE 2
+        return null;
+    }
+
+    /**
+     * Get the base64 encoding of the hash
+     * @return the hash in base64
+     */
+    public String getBase64Hash () {
+        // A compléter lors de l'EXERCICE 2
+        return null;
+    }
+
+    /**
+     * Reconstruct hash from base64
+     * @param hashedPassword the hash of the password
+     * @return the decoded hash
+     */
+    private byte[] decodeHash(String hashedPassword) {
+        // A compléter lors de l'EXERCICE 2
+        return null;
+    }
+
+}

src/main/java/fr/univ_amu/fr/formation/m1info/secapp/Main.java

+package fr.univ_amu.fr.formation.m1info.secapp;
+
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.util.Properties;
+
+public class Main {
+
+    public static void checkingPassword (String password) {
+        System.out.println("Checking password");
+        PlainCheck pc = new PlainCheck("mypassword");
+        if (pc.checkPassword(password)) {
+            System.out.println("Password OK");
+        }
+        else {
+            System.out.println("Password NOT OK");
+        }
+    }
+
+    public static void checkingFromFile (String filename) {
+        try (FileInputStream fis = new FileInputStream(filename)) {
+            // A compléter lors de l'EXERCICE 3
+            // checkingPassword(password);
+        }
+        catch (FileNotFoundException e) {
+            System.err.println("File not found");
+        }
+        catch (IOException e) {
+            System.err.println("I/O Error");
+        }
+    }
+
+    public static void main(String[] args) {
+        checkingPassword(args[0]);
+    }
+}

src/main/java/fr/univ_amu/fr/formation/m1info/secapp/PlainCheck.java

+package fr.univ_amu.fr.formation.m1info.secapp;
+
+/**
+ * Check plain password
+ */
+public class PlainCheck {
+
+    /**
+     * The password
+     */
+    private final String password;
+
+    /**
+     * Constructor
+     * @param password the secret password
+     */
+    public PlainCheck(String password) {
+        if (password == null ) {
+            password = "";
+        }
+        this.password = password;
+    }
+
+    /**
+     * Check the password
+     * @param password the password to check
+     * @return true if OK, false otherwise
+     */
+    public boolean checkPassword(String password) {
+        return this.password.equals(password);
+    }
+
+}

src/test/java/fr/univ_amu/fr/formation/m1info/secapp/HashCheckTest.java

+package fr.univ_amu.fr.formation.m1info.secapp;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class HashCheckTest {
+
+    @Test
+    void checkPassword() {
+        HashCheck hc = new HashCheck("mot de passe", false);
+        assertTrue(hc.checkPassword("mot de passe"));
+        assertFalse(hc.checkPassword("Mot de passe"));
+        assertFalse(hc.checkPassword("autre chose"));
+    }
+
+    @Test
+    void getHash() {
+        HashCheck hc = new HashCheck("mot de passe", false);
+        assertEquals("hiPzaSJi6xZwX7N5QtsPMMEcOFJH01wgqJzvtmoi3UQn2lzhW+bykTpLwXSJJ9/L/dgwSZ20Wjdx+y94QB0Hsg==", hc.getBase64Hash());
+    }
+
+    @Test
+    void hashCheck() {
+        HashCheck hc = new HashCheck("hiPzaSJi6xZwX7N5QtsPMMEcOFJH01wgqJzvtmoi3UQn2lzhW+bykTpLwXSJJ9/L/dgwSZ20Wjdx+y94QB0Hsg==", true);
+        assertTrue(hc.checkPassword("mot de passe"));
+        assertFalse(hc.checkPassword("Mot de passe"));
+        assertFalse(hc.checkPassword("autre chose"));
+    }
+}
\ No newline at end of file

src/test/java/fr/univ_amu/fr/formation/m1info/secapp/PlainCheckTest.java

+package fr.univ_amu.fr.formation.m1info.secapp;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class PlainCheckTest {
+
+    @org.junit.jupiter.api.Test
+    void checkPassword() {
+        PlainCheck pc = new PlainCheck("mot de passe");
+        assertTrue(pc.checkPassword("mot de passe"));
+        assertFalse(pc.checkPassword("autre chose"));
+    }
+}
\ No newline at end of file