Add validation for input string (reflecting review comments)

Signed-off-by: Takahiro Nagao <nagao.takahiro@fujitsu.com>
eclipse-ee4j · Dec 16, 2024 · b2a11d9 · b2a11d9
1 parent a5af583
commit b2a11d9
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/...ersistence.core/src/main/java/org/eclipse/persistence/internal/security/JCEEncryptor.java b/...ersistence.core/src/main/java/org/eclipse/persistence/internal/security/JCEEncryptor.java
@@ -128,14 +128,16 @@ private static byte[] getIvGCM() {
             byte[] ivGCM = new byte[IV_GCM_LENGTH];
             SecureRandom random = null;
             String useStrongRNG = PrivilegedAccessHelper.getSystemProperty(SystemProperties.SECURITY_ENCRYPTOR_USE_STRONG_RANDOM_NUMBER_GENERATOR);
-            if (Boolean.parseBoolean(useStrongRNG)) {
+            if (useStrongRNG == null || useStrongRNG.equalsIgnoreCase("false")) {
+                random = new SecureRandom();
+            } else if (useStrongRNG.equalsIgnoreCase("true")) {
                 try {
                     random = SecureRandom.getInstanceStrong();
                 } catch (NoSuchAlgorithmException e) {
                     throw new RuntimeException(e);
                 }
             } else {
-                random = new SecureRandom();
+                throw ValidationException.invalidBooleanValueForProperty(useStrongRNG, SystemProperties.SECURITY_ENCRYPTOR_USE_STRONG_RANDOM_NUMBER_GENERATOR);
             }
             random.nextBytes(ivGCM);
             return ivGCM;