From 2bef709cfdeb32d625cdb6eaf5e9122f42bb5966 Mon Sep 17 00:00:00 2001 From: Daniel Gredler Date: Tue, 28 Aug 2018 15:07:02 -0400 Subject: [PATCH] Be explicit about charset when calling String.getBytes() --- .../java/com/threerings/getdown/tools/AppletParamSigner.java | 4 +++- src/main/java/com/threerings/getdown/util/Base64.java | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/main/java/com/threerings/getdown/tools/AppletParamSigner.java b/src/main/java/com/threerings/getdown/tools/AppletParamSigner.java index 0ff4d89..15d540d 100644 --- a/src/main/java/com/threerings/getdown/tools/AppletParamSigner.java +++ b/src/main/java/com/threerings/getdown/tools/AppletParamSigner.java @@ -14,6 +14,8 @@ import java.security.Signature; import com.threerings.getdown.data.Digest; import com.threerings.getdown.util.Base64; +import static java.nio.charset.StandardCharsets.UTF_8; + /** * Produces a signed hash of the appbase, appname, and image path to ensure that signed copies of * Getdown are not hijacked to run malicious code. @@ -45,7 +47,7 @@ public class AppletParamSigner PrivateKey key = (PrivateKey)store.getKey(alias, keypass.toCharArray()); Signature sig = Signature.getInstance(Digest.sigAlgorithm(Digest.VERSION)); sig.initSign(key); - sig.update(params.getBytes()); + sig.update(params.getBytes(UTF_8)); String signed = Base64.encodeToString(sig.sign(), Base64.DEFAULT); System.out.println(""); System.out.println(""); diff --git a/src/main/java/com/threerings/getdown/util/Base64.java b/src/main/java/com/threerings/getdown/util/Base64.java index ee3aa42..e00a991 100644 --- a/src/main/java/com/threerings/getdown/util/Base64.java +++ b/src/main/java/com/threerings/getdown/util/Base64.java @@ -107,7 +107,7 @@ public class Base64 { * if any are present, there must be the correct number of them. * * @param str the input String to decode, which is converted to - * bytes using the default charset + * bytes using ASCII * @param flags controls certain features of the decoded output. * Pass {@code DEFAULT} to decode standard Base64. * @@ -115,7 +115,7 @@ public class Base64 { * incorrect padding */ public static byte[] decode(String str, int flags) { - return decode(str.getBytes(), flags); + return decode(str.getBytes(US_ASCII), flags); } /**