浏览代码

SEC-478: Handle incorrect Base64 cookie encoding.

Ben Alex 18 年之前
父节点
当前提交
f45c0944ef
共有 1 个文件被更改,包括 4 次插入0 次删除
  1. 4 0
      core/src/main/java/org/acegisecurity/ui/rememberme/TokenBasedRememberMeServices.java

+ 4 - 0
core/src/main/java/org/acegisecurity/ui/rememberme/TokenBasedRememberMeServices.java

@@ -118,6 +118,10 @@ public class TokenBasedRememberMeServices implements RememberMeServices, Initial
             if (ACEGI_SECURITY_HASHED_REMEMBER_ME_COOKIE_KEY.equals(cookies[i].getName())) {
                 String cookieValue = cookies[i].getValue();
 
+                for (int j = 0; j < cookieValue.length() % 4; j++) {
+                    cookieValue = cookieValue + "=";
+                } 
+                
                 if (Base64.isArrayByteBase64(cookieValue.getBytes())) {
                     if (logger.isDebugEnabled()) {
                         logger.debug("Remember-me cookie detected");