Cherry pick branch 'genexuslabs:gamutils_eo' into beta

Author: sgrampone

gamutils/src/main/java/com/genexus/gam/utils/Pkce.java

@@ -5,10 +5,11 @@
 import org.apache.logging.log4j.Logger;
 import org.bouncycastle.crypto.Digest;
 import org.bouncycastle.crypto.digests.SHA256Digest;
-import org.bouncycastle.util.encoders.UrlBase64;
 
 import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
 import java.text.MessageFormat;
+import java.util.Base64;
 
 @SuppressWarnings("LoggingSimilarMessage")
 public class Pkce {
@@ -17,28 +18,29 @@ public class Pkce {
 
 	public static String create(int len, String option) {
 		logger.trace("create");
-		String code_verifier = Random.alphanumeric(len);
+		byte[] code_verifier_bytes = getRandomBytes(len);
+		String code_verifier = Base64.getUrlEncoder().withoutPadding().encodeToString(code_verifier_bytes);
 		switch (option.toUpperCase().trim()) {
 			case "S256":
-				byte[] digest = hash(new SHA256Digest(), code_verifier.getBytes(StandardCharsets.UTF_8));
-				return MessageFormat.format("{0},{1}", code_verifier.trim(), new String(UrlBase64.encode(digest)));
+				byte[] digest = hash(new SHA256Digest(), code_verifier.getBytes(StandardCharsets.US_ASCII));
+				return MessageFormat.format("{0},{1}", code_verifier, Base64.getUrlEncoder().withoutPadding().encodeToString(digest));
 			case "PLAIN":
-				return MessageFormat.format("{0},{1}", code_verifier.trim(), Encoding.toBase64Url(code_verifier.trim()));
+				return MessageFormat.format("{0},{1}", code_verifier, code_verifier);
 			default:
 				logger.error("Unknown PKCE option");
 				return "";
 		}
+
 	}
 
 	public static boolean verify(String code_verifier, String code_challenge, String option) {
 		logger.trace("verify");
 		switch (option.toUpperCase().trim()) {
 			case "S256":
-				byte[] digest = hash(new SHA256Digest(), code_verifier.trim().getBytes(StandardCharsets.UTF_8));
-				return (new String(UrlBase64.encode(digest))).equals(code_challenge.trim());
+				byte[] digest = hash(new SHA256Digest(), code_verifier.trim().getBytes(StandardCharsets.US_ASCII));
+				return Base64.getUrlEncoder().withoutPadding().encodeToString(digest).equals(code_challenge.trim());
 			case "PLAIN":
-				byte[] bytes_plain = UrlBase64.decode(code_challenge.trim().getBytes(StandardCharsets.UTF_8));
-				return new String(bytes_plain).equals(code_verifier.trim());
+				return code_challenge.trim().equals(code_verifier.trim());
 			default:
 				logger.error("Unknown PKCE option");
 				return false;
@@ -51,4 +53,12 @@ private static byte[] hash(Digest digest, byte[] inputBytes) {
 		digest.doFinal(retValue, 0);
 		return retValue;
 	}
+
+	private static byte[] getRandomBytes(int len) {
+		logger.trace("getRandomBytes");
+		SecureRandom secureRandom = new SecureRandom();
+		byte[] bytes = new byte[len];
+		secureRandom.nextBytes(bytes);
+		return bytes;
+	}
 }