From ee85543dbe1053f322a6b72b833f86c4335863b1 Mon Sep 17 00:00:00 2001 From: "deepsource-dev-autofix[bot]" <61578317+deepsource-dev-autofix[bot]@users.noreply.github.com> Date: Mon, 14 Jul 2025 22:33:05 +0530 Subject: [PATCH 1/2] refactor: replace risky RijndaelManaged with Aes --- .../Crypto/CryptoHelper.cs | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/mojoPortal.Web.Framework/Crypto/CryptoHelper.cs b/mojoPortal.Web.Framework/Crypto/CryptoHelper.cs index fd33bd132..f602588fe 100644 --- a/mojoPortal.Web.Framework/Crypto/CryptoHelper.cs +++ b/mojoPortal.Web.Framework/Crypto/CryptoHelper.cs @@ -176,17 +176,21 @@ public static string DecryptRijndaelManaged(string value) { if (value == string.Empty) return string.Empty; - RijndaelManaged crypto = new RijndaelManaged(); - MemoryStream memoryStream = new MemoryStream(Convert.FromBase64String(value)); - - CryptoStream cryptoStream = new CryptoStream( - memoryStream, - crypto.CreateDecryptor(key_192, iv_128), - CryptoStreamMode.Read); - - StreamReader streamReader = new StreamReader(cryptoStream); - - return streamReader.ReadToEnd(); + using (Aes aes = Aes.Create()) + { + aes.Key = key_192; + aes.IV = iv_128; + + using (MemoryStream memoryStream = new MemoryStream(Convert.FromBase64String(value))) + using (CryptoStream cryptoStream = new CryptoStream( + memoryStream, + aes.CreateDecryptor(), + CryptoStreamMode.Read)) + using (StreamReader streamReader = new StreamReader(cryptoStream)) + { + return streamReader.ReadToEnd(); + } + } } public static string SignAndSecureData(string value) From 12f3130775371a043dda2bab644cce191dd86c11 Mon Sep 17 00:00:00 2001 From: "deepsource-autofix[bot]" <62050782+deepsource-autofix[bot]@users.noreply.github.com> Date: Mon, 14 Jul 2025 17:03:30 +0000 Subject: [PATCH 2/2] style: format code with dotnet-format This commit fixes the style issues introduced in ee85543 according to the output from dotnet-format. Details: https://github.com/QuackatronHQ/mojoportal/pull/2 --- .../Crypto/CryptoHelper.cs | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/mojoPortal.Web.Framework/Crypto/CryptoHelper.cs b/mojoPortal.Web.Framework/Crypto/CryptoHelper.cs index f602588fe..a527f7f1a 100644 --- a/mojoPortal.Web.Framework/Crypto/CryptoHelper.cs +++ b/mojoPortal.Web.Framework/Crypto/CryptoHelper.cs @@ -18,7 +18,7 @@ namespace mojoPortal.Web.Framework { - + public static class CryptoHelper { private static readonly ILog log = LogManager.GetLogger(typeof(CryptoHelper)); @@ -33,7 +33,7 @@ public static class CryptoHelper [Obsolete("This method is obsolete because it does not work in medium trust hosting. It is recomended to use mojoPortal.Web.SiteUtils.Encrypt and Decrypt methods")] public static string Encrypt(string clearText) { - + StringBuilder stringBuilder = new System.Text.StringBuilder(); RSACryptoServiceProvider.UseMachineKeyStore = true; @@ -49,10 +49,10 @@ public static string Encrypt(string clearText) } rsaProvider.FromXmlString(config.RsaKey); - + byte[] encryptedStr; encryptedStr = rsaProvider.Encrypt(Encoding.ASCII.GetBytes(clearText), false); - + for (int i = 0; i <= encryptedStr.Length - 1; i++) { if (i != encryptedStr.Length - 1) @@ -78,7 +78,7 @@ public static string Encrypt(string clearText) [Obsolete("This method is obsolete because it does not work in medium trust hosting. It is recomended to use mojoPortal.Web.SiteUtils.Decrypt and Encrypt methods")] public static string Decrypt(string encryptedText) { - + StringBuilder stringBuilder = new StringBuilder(); RSACryptoServiceProvider.UseMachineKeyStore = true; @@ -93,9 +93,9 @@ public static string Decrypt(string encryptedText) } rsaProvider.FromXmlString(config.RsaKey); - + byte[] decryptedStr = rsaProvider.Decrypt(StringToByteArray(encryptedText.Trim()), false); - + for (int i = 0; i <= decryptedStr.Length - 1; i++) { stringBuilder.Append(Convert.ToChar(decryptedStr[i])); @@ -115,7 +115,7 @@ public static byte[] StringToByteArray(string inputText) for (int i = 0; i <= s.Length - 1; i++) { - b[i] = Convert.ToByte(s[i],CultureInfo.InvariantCulture); + b[i] = Convert.ToByte(s[i], CultureInfo.InvariantCulture); } return b; } @@ -127,7 +127,7 @@ public static string Hash(string cleanText) { Byte[] clearBytes = new UnicodeEncoding().GetBytes(cleanText); - Byte[] hashedBytes + Byte[] hashedBytes = ((HashAlgorithm)CryptoConfig.CreateFromName("MD5")).ComputeHash(clearBytes); return BitConverter.ToString(hashedBytes); @@ -142,13 +142,13 @@ Byte[] hashedBytes // // TODO: move to config, should not be hard coded - private static byte[] key_192 = new byte[] - {10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, - 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10}; + private static byte[] key_192 = new byte[] + {10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, + 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10}; private static byte[] iv_128 = new byte[] - {10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, - 10, 10, 10, 10}; + {10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, + 10, 10, 10, 10}; public static string EncryptRijndaelManaged(string value) { @@ -158,7 +158,7 @@ public static string EncryptRijndaelManaged(string value) MemoryStream memoryStream = new MemoryStream(); CryptoStream cryptoStream = new CryptoStream( - memoryStream, + memoryStream, crypto.CreateEncryptor(key_192, iv_128), CryptoStreamMode.Write); @@ -198,7 +198,7 @@ public static string SignAndSecureData(string value) return SignAndSecureData(new string[] { value }); } - + public static string SignAndSecureData(string[] values) { @@ -231,11 +231,11 @@ public static string SignAndSecureData(string[] values) Core.Helpers.XmlHelper.AddNode(xmlDoc, "s", Convert.ToBase64String(signature, 0, signature.Length)); } - + return EncryptRijndaelManaged(xmlDoc.InnerXml); } - + public static bool DecryptAndVerifyData(string input, out string[] values) { string xml = DecryptRijndaelManaged(input);