diff --git a/backend/deps.edn b/backend/deps.edn index 1450f4de58..5963271594 100644 --- a/backend/deps.edn +++ b/backend/deps.edn @@ -17,7 +17,7 @@ io.prometheus/simpleclient_httpserver {:mvn/version "0.16.0"} - io.lettuce/lettuce-core {:mvn/version "7.6.0.RELEASE"} + io.lettuce/lettuce-core {:mvn/version "7.7.0.RELEASE"} ;; Minimal dependencies required by lettuce, we need to include them ;; explicitly because clojure dependency management does not support ;; yet the BOM format. @@ -25,7 +25,7 @@ io.micrometer/micrometer-observation {:mvn/version "1.14.2"} java-http-clj/java-http-clj {:mvn/version "0.4.3"} - com.google.guava/guava {:mvn/version "33.6.0-jre"} + com.google.guava/guava {:mvn/version "33.7.1-jre"} funcool/yetti {:git/tag "v11.10" @@ -40,32 +40,32 @@ nrepl/nrepl {:mvn/version "1.7.0"} org.postgresql/postgresql {:mvn/version "42.7.13"} - org.xerial/sqlite-jdbc {:mvn/version "3.53.2.1"} + org.xerial/sqlite-jdbc {:mvn/version "3.53.4.0"} com.zaxxer/HikariCP {:mvn/version "7.1.0"} - io.whitfin/siphash {:mvn/version "2.0.0"} + io.whitfin/siphash {:mvn/version "3.0.0"} buddy/buddy-hashers {:mvn/version "2.0.167"} buddy/buddy-sign {:mvn/version "3.6.1-359"} - org.passay/passay {:mvn/version "1.6.6"} + org.passay/passay {:mvn/version "2.0.0"} com.github.ben-manes.caffeine/caffeine {:mvn/version "3.2.4"} - org.jsoup/jsoup {:mvn/version "1.23.1"} + org.jsoup/jsoup {:mvn/version "1.23.2"} at.yawk.lz4/lz4-java - {:mvn/version "1.11.1"} + {:mvn/version "1.11.2"} org.clojars.pntblnk/clj-ldap {:mvn/version "0.0.17"} dawran6/emoji {:mvn/version "0.2.0"} - markdown-clj/markdown-clj {:mvn/version "1.12.8"} + markdown-clj/markdown-clj {:mvn/version "1.12.9"} ;; Pretty Print specs pretty-spec/pretty-spec {:mvn/version "0.1.4"} - software.amazon.awssdk/s3 {:mvn/version "2.50.1"} - software.amazon.awssdk/sts {:mvn/version "2.50.1"}} + software.amazon.awssdk/s3 {:mvn/version "2.54.5"} + software.amazon.awssdk/sts {:mvn/version "2.54.5"}} :paths ["src" "resources" "target/classes"] :aliases diff --git a/backend/src/app/auth/passwords.clj b/backend/src/app/auth/passwords.clj index cc75b202b7..c047b66b5a 100644 --- a/backend/src/app/auth/passwords.clj +++ b/backend/src/app/auth/passwords.clj @@ -9,7 +9,9 @@ (:require [app.common.exceptions :as ex]) (:import - [org.passay CharacterCharacteristicsRule CharacterRule EnglishCharacterData PasswordData])) + [org.passay PasswordData] + [org.passay.data EnglishCharacterData] + [org.passay.rule CharacterCharacteristicsRule CharacterRule])) (defonce ^:private passay-code->translation-key {"INSUFFICIENT_LOWERCASE" "errors.weak-password.insufficient-lowercase" @@ -18,12 +20,13 @@ "INSUFFICIENT_SPECIAL" "errors.weak-password.insufficient-special"}) (defonce ^:private character-characteristics-rule - (doto (CharacterCharacteristicsRule.) - (.setRules [(CharacterRule. EnglishCharacterData/LowerCase 1) + (CharacterCharacteristicsRule. + 4 + (into-array org.passay.rule.CharacterRule + [(CharacterRule. EnglishCharacterData/LowerCase 1) (CharacterRule. EnglishCharacterData/UpperCase 1) (CharacterRule. EnglishCharacterData/Digit 1) - (CharacterRule. EnglishCharacterData/Special 1)]) - (.setNumberOfCharacteristics 4))) + (CharacterRule. EnglishCharacterData/Special 1)]))) (defn validate-password "Validates password strength. diff --git a/backend/src/app/db.clj b/backend/src/app/db.clj index f10b0089a0..07f4d9aeb7 100644 --- a/backend/src/app/db.clj +++ b/backend/src/app/db.clj @@ -31,8 +31,8 @@ com.zaxxer.hikari.HikariDataSource com.zaxxer.hikari.HikariPoolMXBean com.zaxxer.hikari.metrics.prometheus.PrometheusMetricsTrackerFactory - io.whitfin.siphash.SipHasher - io.whitfin.siphash.SipHasherContainer + io.whitfin.siphash.SipHash + io.whitfin.siphash.SipHashContext java.io.InputStream java.io.OutputStream java.sql.Connection @@ -701,12 +701,12 @@ ;; --- Locks (def ^:private siphash-state - (SipHasher/container - (uuid/get-bytes uuid/zero))) + (SipHash/context + (uuid/get-bytes uuid/zero))) (defn uuid->hash-code [o] - (.hash ^SipHasherContainer siphash-state + (.hash ^SipHashContext siphash-state ^bytes (uuid/get-bytes o))) (defn- xact-check-param diff --git a/backend/test/backend_tests/db_test.clj b/backend/test/backend_tests/db_test.clj index 3d228bc8c1..94125a32b7 100644 --- a/backend/test/backend_tests/db_test.clj +++ b/backend/test/backend_tests/db_test.clj @@ -6,6 +6,7 @@ (ns backend-tests.db-test (:require + [app.common.uuid :as uuid] [app.db :as db] [backend-tests.helpers :as th] [clojure.test :as t]) @@ -41,3 +42,13 @@ (t/testing "maximum pool size is reasonable" (t/is (pos? (:maximum-pool-size stats)))))) + +(t/deftest uuid->hash-code-is-deterministic + (t/is (= (db/uuid->hash-code uuid/zero) + (db/uuid->hash-code uuid/zero)))) + +(t/deftest uuid->hash-code-returns-long + (t/is (instance? Long (db/uuid->hash-code uuid/zero)))) + +(t/deftest uuid->hash-code-stable-for-zero-uuid + (t/is (= 3659997967308761462 (db/uuid->hash-code uuid/zero)))) diff --git a/backend/test/backend_tests/passwords_test.clj b/backend/test/backend_tests/passwords_test.clj new file mode 100644 index 0000000000..75a880a5de --- /dev/null +++ b/backend/test/backend_tests/passwords_test.clj @@ -0,0 +1,51 @@ +;; This Source Code Form is subject to the terms of the Mozilla Public +;; License, v. 2.0. If a copy of the MPL was not distributed with this +;; file, You can obtain one at http://mozilla.org/MPL/2.0/. +;; +;; Copyright (c) KALEIDOS INC Sucursal en EspaƱa SL + +(ns backend-tests.passwords-test + (:require + [app.auth.passwords :as passwords] + [backend-tests.helpers :as th] + [clojure.test :as t])) + +(defn- run-validation + [password] + (try + (passwords/validate-password password) + nil + (catch Throwable e + e))) + +(t/deftest validate-password-accepts-strong-password + (t/is (nil? (run-validation "Str0ng!Pass")))) + +(t/deftest validate-password-rejects-too-short-password + (let [error (run-validation "Ab1!x")] + (t/is (th/ex-of-code? error :weak-password)) + (t/is (= ["errors.weak-password.too-short"] (:details (ex-data error)))))) + +(t/deftest validate-password-rejects-missing-lowercase + (let [error (run-validation "ABCDEFG1!")] + (t/is (th/ex-of-code? error :weak-password)) + (t/is (= ["errors.weak-password.insufficient-lowercase"] + (:details (ex-data error)))))) + +(t/deftest validate-password-rejects-missing-uppercase + (let [error (run-validation "abcdefg1!")] + (t/is (th/ex-of-code? error :weak-password)) + (t/is (= ["errors.weak-password.insufficient-uppercase"] + (:details (ex-data error)))))) + +(t/deftest validate-password-rejects-missing-digit + (let [error (run-validation "Abcdefgh!")] + (t/is (th/ex-of-code? error :weak-password)) + (t/is (= ["errors.weak-password.insufficient-digits"] + (:details (ex-data error)))))) + +(t/deftest validate-password-rejects-missing-special + (let [error (run-validation "Abcdefgh1")] + (t/is (th/ex-of-code? error :weak-password)) + (t/is (= ["errors.weak-password.insufficient-special"] + (:details (ex-data error)))))) \ No newline at end of file diff --git a/common/deps.edn b/common/deps.edn index edffb487f0..1a409e0d12 100644 --- a/common/deps.edn +++ b/common/deps.edn @@ -17,14 +17,14 @@ org.slf4j/slf4j-api {:mvn/version "2.0.18"} pl.tkowalcz.tjahzi/log4j2-appender {:mvn/version "0.9.43"} - selmer/selmer {:mvn/version "1.13.4"} + selmer/selmer {:mvn/version "1.13.5"} criterium/criterium {:mvn/version "0.4.6"} metosin/jsonista {:mvn/version "1.0.0" :exclusions [com.fasterxml.jackson.core/jackson-core com.fasterxml.jackson.core/jackson-databind]} - com.fasterxml.jackson.core/jackson-core {:mvn/version "2.22.1"} - com.fasterxml.jackson.core/jackson-databind {:mvn/version "2.22.1"} + com.fasterxml.jackson.core/jackson-core {:mvn/version "2.22.2"} + com.fasterxml.jackson.core/jackson-databind {:mvn/version "2.22.2"} metosin/malli {:mvn/version "0.20.1"} @@ -60,7 +60,7 @@ {:dev {:extra-deps {org.clojure/tools.namespace {:mvn/version "1.5.1"} - thheller/shadow-cljs {:mvn/version "3.4.11"} + thheller/shadow-cljs {:mvn/version "3.5.0"} com.clojure-goes-fast/clj-async-profiler {:mvn/version "2.0.0-beta1"} com.bhauman/rebel-readline {:mvn/version "0.1.11"} criterium/criterium {:mvn/version "0.4.6"} diff --git a/exporter/deps.edn b/exporter/deps.edn index 9495142719..4d8391f6de 100644 --- a/exporter/deps.edn +++ b/exporter/deps.edn @@ -14,7 +14,7 @@ :dev {:extra-deps - {thheller/shadow-cljs {:mvn/version "3.4.11"}}} + {thheller/shadow-cljs {:mvn/version "3.5.0"}}} :shadow-cljs {:main-opts ["-m" "shadow.cljs.devtools.cli"] diff --git a/frontend/deps.edn b/frontend/deps.edn index a662b7086d..8688b4a99a 100644 --- a/frontend/deps.edn +++ b/frontend/deps.edn @@ -3,7 +3,7 @@ {penpot/common {:local/root "../common"} - org.clojure/clojure {:mvn/version "1.12.2"} + org.clojure/clojure {:mvn/version "1.12.5"} binaryage/devtools {:mvn/version "RELEASE"} metosin/reitit-core {:mvn/version "0.10.1"} funcool/okulary {:mvn/version "2022.04.11-16"} @@ -50,7 +50,7 @@ "--enable-native-access=ALL-UNNAMED"] :extra-deps - {thheller/shadow-cljs {:mvn/version "3.4.11"} + {thheller/shadow-cljs {:mvn/version "3.5.0"} com.bhauman/rebel-readline {:mvn/version "RELEASE"} org.clojure/tools.namespace {:mvn/version "RELEASE"} criterium/criterium {:mvn/version "0.4.6"}}}