#1627 Replace BCryptService with Maven dependency (#1629)

* #1627 Replace BCryptService with Maven dependency
- Remove BCryptService in favor of a better BCrypt implementation (Maven dependency)
- Introduce BCryptHasher wrapping the dependency with more suitable methods
- Fix inaccurate details about salt length in docu annotation: for BCrypt it's always 22 chars
- Change phpBB hash to produce 2y hashes instead of 2a

* #1627 Use UTF-8 encoding when (dis)assembling Strings

* #1627 Small test additions

src/test/java/fr/xephi/authme/security/HashUtilsTest.java

@@ -117,10 +117,11 @@ public class HashUtilsTest {
     public void shouldCheckForValidBcryptHashStart() {
         // given / when / then
         assertThat(HashUtils.isValidBcryptHash(""), equalTo(false));
-        assertThat(HashUtils.isValidBcryptHash("$2afsdaf"), equalTo(true));
         assertThat(HashUtils.isValidBcryptHash("$2"), equalTo(false));
-        assertThat(HashUtils.isValidBcryptHash("$2aead234adef"), equalTo(true));
         assertThat(HashUtils.isValidBcryptHash("#2ae5fc78"), equalTo(false));
+        assertThat(HashUtils.isValidBcryptHash("$2afsdaf"), equalTo(false));
+        assertThat(HashUtils.isValidBcryptHash("$fdfasdfasdfasdfasdfasdfasdfasdfasdfasdfsadfasdfasdfasdfasdf"), equalTo(false));
+        assertThat(HashUtils.isValidBcryptHash("$2y$asdfasdfasdfasdfasdfasdfasdfasdfasdfsadfasdfasdfasdfasdf"), equalTo(true));
     }
 
     @Test

src/test/java/fr/xephi/authme/security/crypts/BCrypt2yTest.java

@@ -1,5 +1,11 @@
 package fr.xephi.authme.security.crypts;
 
+import org.junit.Test;
+
+import static org.hamcrest.Matchers.nullValue;
+import static org.hamcrest.Matchers.startsWith;
+import static org.junit.Assert.assertThat;
+
 /**
  * Test for {@link BCrypt2y}.
  */
@@ -13,4 +19,16 @@ public class BCrypt2yTest extends AbstractEncryptionMethodTest {
             "$2y$10$a8097db1fa4423b93f1b2eF6rMAGFkSX178fpROf/OvCFtrDebp6K"); // âË_3(íù*
     }
 
+    @Test
+    public void shouldGenerateWith2yPrefixAndCostFactor10() {
+        // given
+        BCrypt2y bCrypt2y = new BCrypt2y();
+
+        // when
+        HashedPassword result = bCrypt2y.computeHash("test", null);
+
+        // then
+        assertThat(result.getHash(), startsWith("$2y$10$"));
+        assertThat(result.getSalt(), nullValue());
+    }
 }

src/test/java/fr/xephi/authme/security/crypts/BCryptTest.java

@@ -2,7 +2,10 @@ package fr.xephi.authme.security.crypts;
 
 import fr.xephi.authme.settings.Settings;
 import fr.xephi.authme.settings.properties.HooksSettings;
+import org.junit.Test;
 
+import static org.hamcrest.Matchers.startsWith;
+import static org.junit.Assert.assertThat;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
 
@@ -20,10 +23,21 @@ public class BCryptTest extends AbstractEncryptionMethodTest {
         );
     }
 
+    @Test
+    public void shouldGenerateWith2aPrefix() {
+        // given
+        BCrypt bCrypt = new BCrypt(mockSettings());
+
+        // when
+        HashedPassword result = bCrypt.computeHash("test", null);
+
+        // then
+        assertThat(result.getHash(), startsWith("$2a$08$"));
+    }
+
     private static Settings mockSettings() {
         Settings settings = mock(Settings.class);
         given(settings.getProperty(HooksSettings.BCRYPT_LOG2_ROUND)).willReturn(8);
         return settings;
     }
-
 }

src/test/java/fr/xephi/authme/security/crypts/Ipb4Test.java

@@ -1,5 +1,13 @@
 package fr.xephi.authme.security.crypts;
 
+import org.junit.Test;
+
+import static fr.xephi.authme.AuthMeMatchers.stringWithLength;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.startsWith;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assert.fail;
+
 /**
  * Test for {@link Ipb4}.
  */
@@ -13,4 +21,32 @@ public class Ipb4Test extends AbstractEncryptionMethodTest {
             new HashedPassword("$2a$13$18dKXZLoGpeHHL81edM9HuipiUcMjn5VDJHlxwRUMRXfJ1b.ZQrJ.", "18dKXZLoGpeHHL81edM9H6")); //âË_3(íù*
     }
 
+    @Test
+    public void shouldCreateHashesWith2aAndCostFactor13() {
+        // given
+        Ipb4 hashMethod = new Ipb4();
+
+        // when
+        HashedPassword result = hashMethod.computeHash("test", "name");
+
+        // then
+        assertThat(result.getHash(), startsWith("$2a$13$"));
+        assertThat(result.getSalt(), stringWithLength(22));
+    }
+
+    @Test
+    public void shouldThrowForInvalidSalt() {
+        // given
+        Ipb4 hashMethod = new Ipb4();
+
+        // when
+        try {
+            hashMethod.computeHash("pass", "invalid salt", "name");
+
+            // then
+            fail("Expected exception to be thrown");
+        } catch (IllegalStateException e) {
+            assertThat(e.getMessage(), containsString("Cannot parse hash with salt"));
+        }
+    }
 }

src/test/java/fr/xephi/authme/security/crypts/XfBCryptTest.java

@@ -1,5 +1,11 @@
 package fr.xephi.authme.security.crypts;
 
+import org.junit.Test;
+
+import static org.hamcrest.Matchers.nullValue;
+import static org.hamcrest.Matchers.startsWith;
+import static org.junit.Assert.assertThat;
+
 /**
  * Test for {@link XfBCrypt}.
  */
@@ -12,4 +18,17 @@ public class XfBCryptTest extends AbstractEncryptionMethodTest {
             "$2a$10$yHjm02.K4HP5iFU1F..yLeTeo7PWZVbKAr/QGex5jU4.J3mdq/uuO",  // &^%te$t?Pw@_
             "$2a$10$joIayhGStExKWxNbiqMMPOYFSpQ76HVNjpOB7.QwTmG5q.TiJJ.0e"); // âË_3(íù*
     }
+
+    @Test
+    public void shouldGenerateWith2aPrefixAndCostFactor10() {
+        // given
+        XfBCrypt xfBCrypt = new XfBCrypt();
+
+        // when
+        HashedPassword result = xfBCrypt.computeHash("test", null);
+
+        // then
+        assertThat(result.getHash(), startsWith("$2a$10$"));
+        assertThat(result.getSalt(), nullValue());
+    }
 }