1
2
3
4
5
6
7
8
9
10
11 package org.eclipse.jgit.util.sha1;
12
13 import static java.nio.charset.StandardCharsets.UTF_8;
14 import static org.junit.Assert.assertEquals;
15 import static org.junit.Assert.assertTrue;
16 import static org.junit.Assert.fail;
17 import static org.junit.Assume.assumeTrue;
18
19 import java.io.IOException;
20 import java.io.InputStream;
21 import java.nio.ByteBuffer;
22 import java.security.MessageDigest;
23 import java.security.NoSuchAlgorithmException;
24
25 import org.eclipse.jgit.lib.Constants;
26 import org.eclipse.jgit.lib.ObjectId;
27 import org.eclipse.jgit.util.IO;
28 import org.junit.Test;
29
30 public class SHA1Test {
31 private static final String TEST1 = "abc";
32
33 private static final String TEST2a = "abcdbcdecdefdefgefghfghighijhi";
34 private static final String TEST2b = "jkijkljklmklmnlmnomnopnopq";
35 private static final String TEST2 = TEST2a + TEST2b;
36
37 @Test
38 public void test0() throws NoSuchAlgorithmException {
39 ObjectId exp = ObjectId
40 .fromString("da39a3ee5e6b4b0d3255bfef95601890afd80709");
41
42 MessageDigest m = MessageDigest.getInstance("SHA-1");
43 m.update(new byte[] {});
44 ObjectId m1 = ObjectId.fromRaw(m.digest());
45
46 SHA1 s = SHA1.newInstance();
47 s.update(new byte[] {});
48 ObjectId s1 = ObjectId.fromRaw(s.digest());
49
50 s.reset();
51 s.update(new byte[] {});
52 ObjectId s2 = s.toObjectId();
53
54 assertEquals(m1, s1);
55 assertEquals(exp, s1);
56 assertEquals(exp, s2);
57 }
58
59 @Test
60 public void test1() throws NoSuchAlgorithmException {
61 ObjectId exp = ObjectId
62 .fromString("a9993e364706816aba3e25717850c26c9cd0d89d");
63
64 MessageDigest m = MessageDigest.getInstance("SHA-1");
65 m.update(TEST1.getBytes(UTF_8));
66 ObjectId m1 = ObjectId.fromRaw(m.digest());
67
68 SHA1 s = SHA1.newInstance();
69 s.update(TEST1.getBytes(UTF_8));
70 ObjectId s1 = ObjectId.fromRaw(s.digest());
71
72 s.reset();
73 s.update(TEST1.getBytes(UTF_8));
74 ObjectId s2 = s.toObjectId();
75
76 assertEquals(m1, s1);
77 assertEquals(exp, s1);
78 assertEquals(exp, s2);
79 }
80
81 @Test
82 public void test2() throws NoSuchAlgorithmException {
83 ObjectId exp = ObjectId
84 .fromString("84983e441c3bd26ebaae4aa1f95129e5e54670f1");
85
86 MessageDigest m = MessageDigest.getInstance("SHA-1");
87 m.update(TEST2.getBytes(UTF_8));
88 ObjectId m1 = ObjectId.fromRaw(m.digest());
89
90 SHA1 s = SHA1.newInstance();
91 s.update(TEST2.getBytes(UTF_8));
92 ObjectId s1 = ObjectId.fromRaw(s.digest());
93
94 s.reset();
95 s.update(TEST2.getBytes(UTF_8));
96 ObjectId s2 = s.toObjectId();
97
98 assertEquals(m1, s1);
99 assertEquals(exp, s1);
100 assertEquals(exp, s2);
101 }
102
103 @Test
104 public void shatteredCollision()
105 throws IOException, NoSuchAlgorithmException {
106 byte[] pdf1 = read("shattered-1.pdf", 422435);
107 byte[] pdf2 = read("shattered-2.pdf", 422435);
108 MessageDigest md;
109 SHA1 s;
110
111
112 ObjectId bad = ObjectId
113 .fromString("38762cf7f55934b34d179ae6a4c80cadccbb7f0a");
114 md = MessageDigest.getInstance("SHA-1");
115 md.update(pdf1);
116 assertEquals("shattered-1 collides", bad,
117 ObjectId.fromRaw(md.digest()));
118 s = SHA1.newInstance().setDetectCollision(false);
119 s.update(pdf1);
120 assertEquals("shattered-1 collides", bad, s.toObjectId());
121
122 md = MessageDigest.getInstance("SHA-1");
123 md.update(pdf2);
124 assertEquals("shattered-2 collides", bad,
125 ObjectId.fromRaw(md.digest()));
126 s = SHA1.newInstance().setDetectCollision(false);
127 s.update(pdf2);
128 assertEquals("shattered-2 collides", bad, s.toObjectId());
129
130
131 s = SHA1.newInstance().setDetectCollision(true);
132 s.update(pdf1);
133 try {
134 s.digest();
135 fail("expected " + Sha1CollisionException.class.getSimpleName());
136 } catch (Sha1CollisionException e) {
137 assertEquals(e.getMessage(),
138 "SHA-1 collision detected on " + bad.name());
139 }
140
141 s = SHA1.newInstance().setDetectCollision(true);
142 s.update(pdf2);
143 try {
144 s.digest();
145 fail("expected " + Sha1CollisionException.class.getSimpleName());
146 } catch (Sha1CollisionException e) {
147 assertEquals(e.getMessage(),
148 "SHA-1 collision detected on " + bad.name());
149 }
150 }
151
152 @Test
153 public void shatteredStoredInGitBlob() throws IOException {
154 byte[] pdf1 = read("shattered-1.pdf", 422435);
155 byte[] pdf2 = read("shattered-2.pdf", 422435);
156
157
158
159
160
161 ObjectId id1 = blob(pdf1, SHA1.newInstance().setDetectCollision(true));
162 ObjectId id2 = blob(pdf2, SHA1.newInstance().setDetectCollision(true));
163
164 assertEquals(
165 ObjectId.fromString("ba9aaa145ccd24ef760cf31c74d8f7ca1a2e47b0"),
166 id1);
167 assertEquals(
168 ObjectId.fromString("b621eeccd5c7edac9b7dcba35a8d5afd075e24f2"),
169 id2);
170 }
171
172 @Test
173 public void detectsShatteredByDefault() throws IOException {
174 assumeTrue(System.getProperty("org.eclipse.jgit.util.sha1.detectCollision") == null);
175 assumeTrue(System.getProperty("org.eclipse.jgit.util.sha1.safeHash") == null);
176
177 byte[] pdf1 = read("shattered-1.pdf", 422435);
178 SHA1 s = SHA1.newInstance();
179 s.update(pdf1);
180 try {
181 s.digest();
182 fail("expected " + Sha1CollisionException.class.getSimpleName());
183 } catch (Sha1CollisionException e) {
184 assertTrue("shattered-1 detected", true);
185 }
186 }
187
188 private static ObjectId blob(byte[] pdf1, SHA1 s) {
189 s.update(Constants.encodedTypeString(Constants.OBJ_BLOB));
190 s.update((byte) ' ');
191 s.update(Constants.encodeASCII(pdf1.length));
192 s.update((byte) 0);
193 s.update(pdf1);
194 return s.toObjectId();
195 }
196
197 private byte[] read(String name, int sizeHint) throws IOException {
198 try (InputStream in = getClass().getResourceAsStream(name)) {
199 ByteBuffer buf = IO.readWholeStream(in, sizeHint);
200 byte[] r = new byte[buf.remaining()];
201 buf.get(r);
202 return r;
203 }
204 }
205 }