From dc110ce72cb7b55825924aee55069dffcf80620d Mon Sep 17 00:00:00 2001
From: Bruno Bierbaumer <bruno+github@bierbaumer.net>
Date: Mon, 23 Nov 2015 23:18:56 +0100
Subject: [PATCH] more linter warning, disable linter for now

---
 app/build.gradle                              |   4 +
 app/src/main/AndroidManifest.xml              |   4 +-
 .../otp_authenticator/EntriesAdapter.java     |   2 +-
 .../otp_authenticator/MainActivity.java       |   1 -
 .../otp_authenticator/MyApplication.java      |  14 +
 .../otp_authenticator/PRNGFixes.java          | 336 ++++++++++++++++++
 .../otp_authenticator/SecretKeyWrapper.java   |   2 +
 .../otp_authenticator/TOTPHelper.java         |   2 -
 app/src/main/res/layout/row.xml               |   2 -
 app/src/main/res/menu/menu_main.xml           |   4 +-
 app/src/main/res/raw/opensource.html          |   1 +
 app/src/main/res/values/strings.xml           |   4 +-
 12 files changed, 365 insertions(+), 11 deletions(-)
 create mode 100644 app/src/main/java/net/bierbaumer/otp_authenticator/MyApplication.java
 create mode 100644 app/src/main/java/net/bierbaumer/otp_authenticator/PRNGFixes.java

diff --git a/app/build.gradle b/app/build.gradle
index 556b0f1f..d67201eb 100644
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -22,6 +22,10 @@ android {
             testCoverageEnabled = true
         }
     }
+    lintOptions {
+          abortOnError false
+      }
+  }
 }
 
 dependencies {
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 275795b1..98e93d32 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -7,7 +7,9 @@
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:supportsRtl="true"
-        android:theme="@style/AppTheme">
+        android:theme="@style/AppTheme"
+        android:name=".MyApplication"
+        >
         <activity
             android:name=".MainActivity"
             android:label="@string/app_launcher"
diff --git a/app/src/main/java/net/bierbaumer/otp_authenticator/EntriesAdapter.java b/app/src/main/java/net/bierbaumer/otp_authenticator/EntriesAdapter.java
index 84309cb9..1a1c2c40 100644
--- a/app/src/main/java/net/bierbaumer/otp_authenticator/EntriesAdapter.java
+++ b/app/src/main/java/net/bierbaumer/otp_authenticator/EntriesAdapter.java
@@ -41,7 +41,7 @@ public class EntriesAdapter extends BaseAdapter {
         if (v == null) {
             final LayoutInflater vi;
             vi = LayoutInflater.from(parent.getContext());
-            v = vi.inflate(R.layout.row, null);
+            v = vi.inflate(R.layout.row, parent, false);
         }
 
         v.setBackgroundColor(Color.TRANSPARENT);
diff --git a/app/src/main/java/net/bierbaumer/otp_authenticator/MainActivity.java b/app/src/main/java/net/bierbaumer/otp_authenticator/MainActivity.java
index 2df4cbca..dd2fb53d 100644
--- a/app/src/main/java/net/bierbaumer/otp_authenticator/MainActivity.java
+++ b/app/src/main/java/net/bierbaumer/otp_authenticator/MainActivity.java
@@ -10,7 +10,6 @@ import android.os.Handler;
 import android.support.design.widget.Snackbar;
 import android.support.v7.app.AppCompatActivity;
 import android.support.v7.widget.Toolbar;
-import android.util.Log;
 import android.view.ActionMode;
 import android.view.LayoutInflater;
 import android.view.Menu;
diff --git a/app/src/main/java/net/bierbaumer/otp_authenticator/MyApplication.java b/app/src/main/java/net/bierbaumer/otp_authenticator/MyApplication.java
new file mode 100644
index 00000000..58f84c9f
--- /dev/null
+++ b/app/src/main/java/net/bierbaumer/otp_authenticator/MyApplication.java
@@ -0,0 +1,14 @@
+package net.bierbaumer.otp_authenticator;
+
+import android.app.Application;
+import android.util.Log;
+
+public class MyApplication extends Application {
+    @Override
+    public void onCreate() {
+        super.onCreate();
+
+        PRNGFixes.apply();
+        Log.e("AAA", "AAAA");
+    }
+}
diff --git a/app/src/main/java/net/bierbaumer/otp_authenticator/PRNGFixes.java b/app/src/main/java/net/bierbaumer/otp_authenticator/PRNGFixes.java
new file mode 100644
index 00000000..0c5b588e
--- /dev/null
+++ b/app/src/main/java/net/bierbaumer/otp_authenticator/PRNGFixes.java
@@ -0,0 +1,336 @@
+package net.bierbaumer.otp_authenticator;
+
+/*
+ * This software is provided 'as-is', without any express or implied
+ * warranty.  In no event will Google be held liable for any damages
+ * arising from the use of this software.
+ *
+ * Permission is granted to anyone to use this software for any purpose,
+ * including commercial applications, and to alter it and redistribute it
+ * freely, as long as the origin is not misrepresented.
+ */
+
+import android.os.Build;
+import android.os.Process;
+import android.util.Log;
+
+import java.io.ByteArrayOutputStream;
+import java.io.DataInputStream;
+import java.io.DataOutputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.io.UnsupportedEncodingException;
+import java.security.NoSuchAlgorithmException;
+import java.security.Provider;
+import java.security.SecureRandom;
+import java.security.SecureRandomSpi;
+import java.security.Security;
+
+/**
+ * Fixes for the output of the default PRNG having low entropy.
+ *
+ * The fixes need to be applied via {@link #apply()} before any use of Java
+ * Cryptography Architecture primitives. A good place to invoke them is in the
+ * application's {@code onCreate}.
+ */
+public final class PRNGFixes {
+
+    private static final int VERSION_CODE_JELLY_BEAN = 16;
+    private static final int VERSION_CODE_JELLY_BEAN_MR2 = 18;
+    private static final byte[] BUILD_FINGERPRINT_AND_DEVICE_SERIAL =
+            getBuildFingerprintAndDeviceSerial();
+
+    /** Hidden constructor to prevent instantiation. */
+    private PRNGFixes() {}
+
+    /**
+     * Applies all fixes.
+     *
+     * @throws SecurityException if a fix is needed but could not be applied.
+     */
+    public static void apply() {
+        applyOpenSSLFix();
+        installLinuxPRNGSecureRandom();
+    }
+
+    /**
+     * Applies the fix for OpenSSL PRNG having low entropy. Does nothing if the
+     * fix is not needed.
+     *
+     * @throws SecurityException if the fix is needed but could not be applied.
+     */
+    private static void applyOpenSSLFix() throws SecurityException {
+        if ((Build.VERSION.SDK_INT < VERSION_CODE_JELLY_BEAN)
+                || (Build.VERSION.SDK_INT > VERSION_CODE_JELLY_BEAN_MR2)) {
+            // No need to apply the fix
+            return;
+        }
+
+        try {
+            // Mix in the device- and invocation-specific seed.
+            Class.forName("org.apache.harmony.xnet.provider.jsse.NativeCrypto")
+                    .getMethod("RAND_seed", byte[].class)
+                    .invoke(null, generateSeed());
+
+            // Mix output of Linux PRNG into OpenSSL's PRNG
+            int bytesRead = (Integer) Class.forName(
+                    "org.apache.harmony.xnet.provider.jsse.NativeCrypto")
+                    .getMethod("RAND_load_file", String.class, long.class)
+                    .invoke(null, "/dev/urandom", 1024);
+            if (bytesRead != 1024) {
+                throw new IOException(
+                        "Unexpected number of bytes read from Linux PRNG: "
+                                + bytesRead);
+            }
+        } catch (Exception e) {
+            throw new SecurityException("Failed to seed OpenSSL PRNG", e);
+        }
+    }
+
+    /**
+     * Installs a Linux PRNG-backed {@code SecureRandom} implementation as the
+     * default. Does nothing if the implementation is already the default or if
+     * there is not need to install the implementation.
+     *
+     * @throws SecurityException if the fix is needed but could not be applied.
+     */
+    private static void installLinuxPRNGSecureRandom()
+            throws SecurityException {
+        if (Build.VERSION.SDK_INT > VERSION_CODE_JELLY_BEAN_MR2) {
+            // No need to apply the fix
+            return;
+        }
+
+        // Install a Linux PRNG-based SecureRandom implementation as the
+        // default, if not yet installed.
+        Provider[] secureRandomProviders =
+                Security.getProviders("SecureRandom.SHA1PRNG");
+        if ((secureRandomProviders == null)
+                || (secureRandomProviders.length < 1)
+                || (!LinuxPRNGSecureRandomProvider.class.equals(
+                secureRandomProviders[0].getClass()))) {
+            Security.insertProviderAt(new LinuxPRNGSecureRandomProvider(), 1);
+        }
+
+        // Assert that new SecureRandom() and
+        // SecureRandom.getInstance("SHA1PRNG") return a SecureRandom backed
+        // by the Linux PRNG-based SecureRandom implementation.
+        SecureRandom rng1 = new SecureRandom();
+        if (!LinuxPRNGSecureRandomProvider.class.equals(
+                rng1.getProvider().getClass())) {
+            throw new SecurityException(
+                    "new SecureRandom() backed by wrong Provider: "
+                            + rng1.getProvider().getClass());
+        }
+
+        SecureRandom rng2;
+        try {
+            rng2 = SecureRandom.getInstance("SHA1PRNG");
+        } catch (NoSuchAlgorithmException e) {
+            throw new SecurityException("SHA1PRNG not available", e);
+        }
+        if (!LinuxPRNGSecureRandomProvider.class.equals(
+                rng2.getProvider().getClass())) {
+            throw new SecurityException(
+                    "SecureRandom.getInstance(\"SHA1PRNG\") backed by wrong"
+                            + " Provider: " + rng2.getProvider().getClass());
+        }
+    }
+
+    /**
+     * {@code Provider} of {@code SecureRandom} engines which pass through
+     * all requests to the Linux PRNG.
+     */
+    private static class LinuxPRNGSecureRandomProvider extends Provider {
+
+        public LinuxPRNGSecureRandomProvider() {
+            super("LinuxPRNG",
+                    1.0,
+                    "A Linux-specific random number provider that uses"
+                            + " /dev/urandom");
+            // Although /dev/urandom is not a SHA-1 PRNG, some apps
+            // explicitly request a SHA1PRNG SecureRandom and we thus need to
+            // prevent them from getting the default implementation whose output
+            // may have low entropy.
+            put("SecureRandom.SHA1PRNG", LinuxPRNGSecureRandom.class.getName());
+            put("SecureRandom.SHA1PRNG ImplementedIn", "Software");
+        }
+    }
+
+    /**
+     * {@link SecureRandomSpi} which passes all requests to the Linux PRNG
+     * ({@code /dev/urandom}).
+     */
+    public static class LinuxPRNGSecureRandom extends SecureRandomSpi {
+
+        /*
+         * IMPLEMENTATION NOTE: Requests to generate bytes and to mix in a seed
+         * are passed through to the Linux PRNG (/dev/urandom). Instances of
+         * this class seed themselves by mixing in the current time, PID, UID,
+         * build fingerprint, and hardware serial number (where available) into
+         * Linux PRNG.
+         *
+         * Concurrency: Read requests to the underlying Linux PRNG are
+         * serialized (on sLock) to ensure that multiple threads do not get
+         * duplicated PRNG output.
+         */
+
+        private static final File URANDOM_FILE = new File("/dev/urandom");
+
+        private static final Object sLock = new Object();
+
+        /**
+         * Input stream for reading from Linux PRNG or {@code null} if not yet
+         * opened.
+         *
+         * @GuardedBy("sLock")
+         */
+        private static DataInputStream sUrandomIn;
+
+        /**
+         * Output stream for writing to Linux PRNG or {@code null} if not yet
+         * opened.
+         *
+         * @GuardedBy("sLock")
+         */
+        private static OutputStream sUrandomOut;
+
+        /**
+         * Whether this engine instance has been seeded. This is needed because
+         * each instance needs to seed itself if the client does not explicitly
+         * seed it.
+         */
+        private boolean mSeeded;
+
+        @Override
+        protected void engineSetSeed(byte[] bytes) {
+            try {
+                OutputStream out;
+                synchronized (sLock) {
+                    out = getUrandomOutputStream();
+                }
+                out.write(bytes);
+                out.flush();
+            } catch (IOException e) {
+                // On a small fraction of devices /dev/urandom is not writable.
+                // Log and ignore.
+                Log.w(PRNGFixes.class.getSimpleName(),
+                        "Failed to mix seed into " + URANDOM_FILE);
+            } finally {
+                mSeeded = true;
+            }
+        }
+
+        @Override
+        protected void engineNextBytes(byte[] bytes) {
+            if (!mSeeded) {
+                // Mix in the device- and invocation-specific seed.
+                engineSetSeed(generateSeed());
+            }
+
+            try {
+                DataInputStream in;
+                synchronized (sLock) {
+                    in = getUrandomInputStream();
+                }
+                synchronized (in) {
+                    in.readFully(bytes);
+                }
+            } catch (IOException e) {
+                throw new SecurityException(
+                        "Failed to read from " + URANDOM_FILE, e);
+            }
+        }
+
+        @Override
+        protected byte[] engineGenerateSeed(int size) {
+            byte[] seed = new byte[size];
+            engineNextBytes(seed);
+            return seed;
+        }
+
+        private DataInputStream getUrandomInputStream() {
+            synchronized (sLock) {
+                if (sUrandomIn == null) {
+                    // NOTE: Consider inserting a BufferedInputStream between
+                    // DataInputStream and FileInputStream if you need higher
+                    // PRNG output performance and can live with future PRNG
+                    // output being pulled into this process prematurely.
+                    try {
+                        sUrandomIn = new DataInputStream(
+                                new FileInputStream(URANDOM_FILE));
+                    } catch (IOException e) {
+                        throw new SecurityException("Failed to open "
+                                + URANDOM_FILE + " for reading", e);
+                    }
+                }
+                return sUrandomIn;
+            }
+        }
+
+        private OutputStream getUrandomOutputStream() throws IOException {
+            synchronized (sLock) {
+                if (sUrandomOut == null) {
+                    sUrandomOut = new FileOutputStream(URANDOM_FILE);
+                }
+                return sUrandomOut;
+            }
+        }
+    }
+
+    /**
+     * Generates a device- and invocation-specific seed to be mixed into the
+     * Linux PRNG.
+     */
+    private static byte[] generateSeed() {
+        try {
+            ByteArrayOutputStream seedBuffer = new ByteArrayOutputStream();
+            DataOutputStream seedBufferOut =
+                    new DataOutputStream(seedBuffer);
+            seedBufferOut.writeLong(System.currentTimeMillis());
+            seedBufferOut.writeLong(System.nanoTime());
+            seedBufferOut.writeInt(Process.myPid());
+            seedBufferOut.writeInt(Process.myUid());
+            seedBufferOut.write(BUILD_FINGERPRINT_AND_DEVICE_SERIAL);
+            seedBufferOut.close();
+            return seedBuffer.toByteArray();
+        } catch (IOException e) {
+            throw new SecurityException("Failed to generate seed", e);
+        }
+    }
+
+    /**
+     * Gets the hardware serial number of this device.
+     *
+     * @return serial number or {@code null} if not available.
+     */
+    private static String getDeviceSerialNumber() {
+        // We're using the Reflection API because Build.SERIAL is only available
+        // since API Level 9 (Gingerbread, Android 2.3).
+        try {
+            return (String) Build.class.getField("SERIAL").get(null);
+        } catch (Exception ignored) {
+            return null;
+        }
+    }
+
+    private static byte[] getBuildFingerprintAndDeviceSerial() {
+        StringBuilder result = new StringBuilder();
+        String fingerprint = Build.FINGERPRINT;
+        if (fingerprint != null) {
+            result.append(fingerprint);
+        }
+        String serial = getDeviceSerialNumber();
+        if (serial != null) {
+            result.append(serial);
+        }
+        try {
+            return result.toString().getBytes("UTF-8");
+        } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException("UTF-8 encoding not supported");
+        }
+    }
+}
\ No newline at end of file
diff --git a/app/src/main/java/net/bierbaumer/otp_authenticator/SecretKeyWrapper.java b/app/src/main/java/net/bierbaumer/otp_authenticator/SecretKeyWrapper.java
index 0a322c4d..3195b5f6 100644
--- a/app/src/main/java/net/bierbaumer/otp_authenticator/SecretKeyWrapper.java
+++ b/app/src/main/java/net/bierbaumer/otp_authenticator/SecretKeyWrapper.java
@@ -16,6 +16,7 @@
 
 package net.bierbaumer.otp_authenticator;
 
+import android.annotation.SuppressLint;
 import android.annotation.TargetApi;
 import android.content.Context;
 import android.os.Build;
@@ -52,6 +53,7 @@ public class SecretKeyWrapper {
      * Create a wrapper using the public/private key pair with the given alias.
      * If no pair with that alias exists, it will be generated.
      */
+    @SuppressLint("GetInstance")
     public SecretKeyWrapper(Context context, String alias)
             throws GeneralSecurityException, IOException {
         mCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
diff --git a/app/src/main/java/net/bierbaumer/otp_authenticator/TOTPHelper.java b/app/src/main/java/net/bierbaumer/otp_authenticator/TOTPHelper.java
index ced4b8d8..bbf6cc52 100644
--- a/app/src/main/java/net/bierbaumer/otp_authenticator/TOTPHelper.java
+++ b/app/src/main/java/net/bierbaumer/otp_authenticator/TOTPHelper.java
@@ -1,7 +1,5 @@
 package net.bierbaumer.otp_authenticator;
 
-import org.apache.commons.codec.binary.Base32;
-
 import javax.crypto.Mac;
 import javax.crypto.spec.SecretKeySpec;
 
diff --git a/app/src/main/res/layout/row.xml b/app/src/main/res/layout/row.xml
index e7d8fd98..e229404f 100644
--- a/app/src/main/res/layout/row.xml
+++ b/app/src/main/res/layout/row.xml
@@ -7,7 +7,6 @@
         android:layout_height="wrap_content"
         android:textSize="28sp"
         android:textStyle="bold"
-        android:text="123456"
         android:id="@+id/textViewOTP"
         android:layout_alignParentTop="true"
         android:layout_alignParentLeft="true"
@@ -17,7 +16,6 @@
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
         android:textAppearance="?android:attr/textAppearanceMedium"
-        android:text="Medium Text"
         android:id="@+id/textViewLabel"
         android:layout_below="@+id/textViewOTP"
         android:layout_alignParentLeft="true"
diff --git a/app/src/main/res/menu/menu_main.xml b/app/src/main/res/menu/menu_main.xml
index a8d164c2..7069ab90 100644
--- a/app/src/main/res/menu/menu_main.xml
+++ b/app/src/main/res/menu/menu_main.xml
@@ -4,13 +4,13 @@
     <item
         android:id="@+id/action_scan"
         android:orderInCategory="100"
-        android:title="Scan QR Code"
+        android:title="@string/menu_scan"
         android:icon="@android:drawable/ic_menu_camera"
         app:showAsAction="ifRoom" />
 
     <item
         android:id="@+id/action_about"
         android:orderInCategory="100"
-        android:title="About"
+        android:title="@string/menu_about"
         app:showAsAction="never" />
 </menu>
diff --git a/app/src/main/res/raw/opensource.html b/app/src/main/res/raw/opensource.html
index ceaa0838..b884de93 100644
--- a/app/src/main/res/raw/opensource.html
+++ b/app/src/main/res/raw/opensource.html
@@ -18,6 +18,7 @@
         }
     </style>
 </head>
+<body>
 <div>
 <h3>Acknowledgments:</h3>
 <ul>
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index 1e2c689f..c8e07374 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -1,9 +1,9 @@
 <resources>
     <string name="app_name">OTP Authenticator</string>
     <string name="app_launcher">Authenticator</string>
-    <string name="action_settings">Settings</string>
-    <string name="action_scan">Scan QR-Code</string>
     <string name="no_accounts">No Account has been added yet</string>
     <string name="menu_delete">Delete</string>
     <string name="menu_edit">Edit</string>
+    <string name="menu_scan">Scan QR Code</string>
+    <string name="menu_about">About</string>
 </resources>