🔒 Fix Weak Password Hashing (SHA-1) -> SHA-256

src/library/assistant/ui/login/LoginController.java

@@ -40,14 +40,33 @@ public void initialize(URL url, ResourceBundle rb) {
     @FXML
     private void handleLoginButtonAction(ActionEvent event) {
         String uname = StringUtils.trimToEmpty(username.getText());
-        String pword = DigestUtils.shaHex(password.getText());
+        String pword = password.getText();
+        String sha256 = DigestUtils.sha256Hex(pword);
+        String sha1 = DigestUtils.shaHex(pword);
+        String storedPassword = preference.getPassword();
 
-        if (uname.equals(preference.getUsername()) && pword.equals(preference.getPassword())) {
+        boolean loginSuccess = false;
+
+        if (uname.equals(preference.getUsername())) {
+            if (sha256.equals(storedPassword)) {
+                loginSuccess = true;
+            } else if (sha1.equals(storedPassword)) {
+                preference.setPassword(pword);
+                try {
+                    Preferences.savePreferencesToDisk(preference);
+                    LOGGER.log(Level.INFO, "Migrated password for user {} to SHA-256", uname);
+                } catch (IOException ex) {
+                    LOGGER.log(Level.ERROR, "Failed to save preferences after migration", ex);
+                }
+                loginSuccess = true;
+            }
+        }
+
+        if (loginSuccess) {
             closeStage();
             loadMain();
             LOGGER.log(Level.INFO, "User successfully logged in {}", uname);
-        }
-        else {
+        } else {
             username.getStyleClass().add("wrong-credentials");
             password.getStyleClass().add("wrong-credentials");
         }

src/library/assistant/ui/settings/Preferences.java

@@ -56,27 +56,15 @@ public String getPassword() {
     }
 
     public void setPassword(String password) {
-        if (password.length() < 16) {
-            this.password = DigestUtils.shaHex(password);
-        }else
-            this.password = password;
+        this.password = DigestUtils.sha256Hex(password);
     }
 
     public static void initConfig() {
-        Writer writer = null;
+        Preferences preference = new Preferences();
         try {
-            Preferences preference = new Preferences();
-            Gson gson = new Gson();
-            writer = new FileWriter(CONFIG_FILE);
-            gson.toJson(preference, writer);
+            savePreferencesToDisk(preference);
         } catch (IOException ex) {
             Logger.getLogger(Preferences.class.getName()).log(Level.SEVERE, null, ex);
-        } finally {
-            try {
-                writer.close();
-            } catch (IOException ex) {
-                Logger.getLogger(Preferences.class.getName()).log(Level.SEVERE, null, ex);
-            }
         }
     }
 
@@ -92,23 +80,26 @@ public static Preferences getPreferences() {
         return preferences;
     }
 
-    public static void writePreferenceToFile(Preferences preference) {
+    public static void savePreferencesToDisk(Preferences preference) throws IOException {
         Writer writer = null;
         try {
             Gson gson = new Gson();
             writer = new FileWriter(CONFIG_FILE);
             gson.toJson(preference, writer);
+        } finally {
+            if (writer != null) {
+                writer.close();
+            }
+        }
+    }
 
+    public static void writePreferenceToFile(Preferences preference) {
+        try {
+            savePreferencesToDisk(preference);
             AlertMaker.showSimpleAlert("Success", "Settings updated");
         } catch (IOException ex) {
             Logger.getLogger(Preferences.class.getName()).log(Level.SEVERE, null, ex);
             AlertMaker.showErrorMessage(ex, "Failed", "Cant save configuration file");
-        } finally {
-            try {
-                writer.close();
-            } catch (IOException ex) {
-                Logger.getLogger(Preferences.class.getName()).log(Level.SEVERE, null, ex);
-            }
         }
     }
 

test/stubs/library/assistant/alert/AlertMaker.java

@@ -0,0 +1,15 @@
+package library.assistant.alert;
+
+public class AlertMaker {
+
+    public static void showSimpleAlert(String title, String content) {
+        System.out.println("STUB: AlertMaker.showSimpleAlert: " + title + " - " + content);
+    }
+
+    public static void showErrorMessage(Exception ex, String title, String content) {
+        System.out.println("STUB: AlertMaker.showErrorMessage: " + title + " - " + content);
+        if (ex != null) {
+            ex.printStackTrace();
+        }
+    }
+}