Skip to content

refactor: replace risky RijndaelManaged with Aes #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
deepsource-dev-autofix wants to merge 2 commits into
base: v2.9.0.1-base
Choose a base branch
from
Open

refactor: replace risky RijndaelManaged with Aes #2

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ee85543
refactor: replace risky RijndaelManaged with Aes
deepsource-dev-autofix[bot] Jul 14, 2025
12f3130
style: format code with dotnet-format
deepsource-autofix[bot] Jul 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 33 additions & 29 deletions mojoPortal.Web.Framework/Crypto/CryptoHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@

namespace mojoPortal.Web.Framework
{

public static class CryptoHelper
{
private static readonly ILog log = LogManager.GetLogger(typeof(CryptoHelper));
Expand All @@ -33,7 +33,7 @@ public static class CryptoHelper
[Obsolete("This method is obsolete because it does not work in medium trust hosting. It is recomended to use mojoPortal.Web.SiteUtils.Encrypt and Decrypt methods")]
public static string Encrypt(string clearText)
{

StringBuilder stringBuilder = new System.Text.StringBuilder();

RSACryptoServiceProvider.UseMachineKeyStore = true;
Expand All @@ -49,10 +49,10 @@ public static string Encrypt(string clearText)
}

rsaProvider.FromXmlString(config.RsaKey);

byte[] encryptedStr;
encryptedStr = rsaProvider.Encrypt(Encoding.ASCII.GetBytes(clearText), false);

for (int i = 0; i <= encryptedStr.Length - 1; i++)
{
if (i != encryptedStr.Length - 1)
Expand All @@ -78,7 +78,7 @@ public static string Encrypt(string clearText)
[Obsolete("This method is obsolete because it does not work in medium trust hosting. It is recomended to use mojoPortal.Web.SiteUtils.Decrypt and Encrypt methods")]
public static string Decrypt(string encryptedText)
{

StringBuilder stringBuilder = new StringBuilder();

RSACryptoServiceProvider.UseMachineKeyStore = true;
Expand All @@ -93,9 +93,9 @@ public static string Decrypt(string encryptedText)
}

rsaProvider.FromXmlString(config.RsaKey);

byte[] decryptedStr = rsaProvider.Decrypt(StringToByteArray(encryptedText.Trim()), false);

for (int i = 0; i <= decryptedStr.Length - 1; i++)
{
stringBuilder.Append(Convert.ToChar(decryptedStr[i]));
Expand All @@ -115,7 +115,7 @@ public static byte[] StringToByteArray(string inputText)

for (int i = 0; i <= s.Length - 1; i++)
{
b[i] = Convert.ToByte(s[i],CultureInfo.InvariantCulture);
b[i] = Convert.ToByte(s[i], CultureInfo.InvariantCulture);
}
return b;
}
Expand All @@ -127,7 +127,7 @@ public static string Hash(string cleanText)
{
Byte[] clearBytes = new UnicodeEncoding().GetBytes(cleanText);

Byte[] hashedBytes
Byte[] hashedBytes
= ((HashAlgorithm)CryptoConfig.CreateFromName("MD5")).ComputeHash(clearBytes);

return BitConverter.ToString(hashedBytes);
Expand All @@ -142,13 +142,13 @@ Byte[] hashedBytes
//

// TODO: move to config, should not be hard coded
private static byte[] key_192 = new byte[]
{10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10};
private static byte[] key_192 = new byte[]
{10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10};

private static byte[] iv_128 = new byte[]
{10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
10, 10, 10, 10};
{10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
10, 10, 10, 10};

public static string EncryptRijndaelManaged(string value)
{
Expand All @@ -158,7 +158,7 @@ public static string EncryptRijndaelManaged(string value)
MemoryStream memoryStream = new MemoryStream();

CryptoStream cryptoStream = new CryptoStream(
memoryStream,
memoryStream,
crypto.CreateEncryptor(key_192, iv_128),
CryptoStreamMode.Write);

Expand All @@ -176,25 +176,29 @@ public static string DecryptRijndaelManaged(string value)
{
if (value == string.Empty) return string.Empty;

RijndaelManaged crypto = new RijndaelManaged();
MemoryStream memoryStream = new MemoryStream(Convert.FromBase64String(value));

CryptoStream cryptoStream = new CryptoStream(
memoryStream,
crypto.CreateDecryptor(key_192, iv_128),
CryptoStreamMode.Read);

StreamReader streamReader = new StreamReader(cryptoStream);

return streamReader.ReadToEnd();
using (Aes aes = Aes.Create())
{
aes.Key = key_192;
aes.IV = iv_128;

using (MemoryStream memoryStream = new MemoryStream(Convert.FromBase64String(value)))
using (CryptoStream cryptoStream = new CryptoStream(
memoryStream,
aes.CreateDecryptor(),
CryptoStreamMode.Read))
using (StreamReader streamReader = new StreamReader(cryptoStream))
{
return streamReader.ReadToEnd();
}
}
}

public static string SignAndSecureData(string value)
{
return SignAndSecureData(new string[] { value });
}



public static string SignAndSecureData(string[] values)
{
Expand Down Expand Up @@ -227,11 +231,11 @@ public static string SignAndSecureData(string[] values)
Core.Helpers.XmlHelper.AddNode(xmlDoc, "s", Convert.ToBase64String(signature, 0, signature.Length));
}


return EncryptRijndaelManaged(xmlDoc.InnerXml);
}


public static bool DecryptAndVerifyData(string input, out string[] values)
{
string xml = DecryptRijndaelManaged(input);
Expand Down