From 4656de43b64532e6bde8282dc07c1ce6f319eb34 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Skj=C3=B8lberg?= Date: Thu, 25 Feb 2021 00:10:21 +0100 Subject: [PATCH] Create less Date objects --- api/src/main/java/io/jsonwebtoken/Clock.java | 10 ++++++++ .../io/jsonwebtoken/impl/DefaultClock.java | 8 ++++-- .../jsonwebtoken/impl/DefaultJwtParser.java | 25 ++++++------------- .../java/io/jsonwebtoken/impl/FixedClock.java | 16 +++++++++--- .../jsonwebtoken/impl/FixedClockTest.groovy | 2 +- 5 files changed, 37 insertions(+), 24 deletions(-) diff --git a/api/src/main/java/io/jsonwebtoken/Clock.java b/api/src/main/java/io/jsonwebtoken/Clock.java index 584dd605f..948076f19 100644 --- a/api/src/main/java/io/jsonwebtoken/Clock.java +++ b/api/src/main/java/io/jsonwebtoken/Clock.java @@ -28,6 +28,16 @@ public interface Clock { * Returns the clock's current timestamp at the instant the method is invoked. * * @return the clock's current timestamp at the instant the method is invoked. + * @deprecated */ Date now(); + + /** + * Returns the clock's current timestamp at the instant the method is invoked. + * + * @return the clock's current timestamp at the instant the method is invoked. + */ + + long millis(); + } diff --git a/impl/src/main/java/io/jsonwebtoken/impl/DefaultClock.java b/impl/src/main/java/io/jsonwebtoken/impl/DefaultClock.java index bd9d4ecbc..712e70792 100644 --- a/impl/src/main/java/io/jsonwebtoken/impl/DefaultClock.java +++ b/impl/src/main/java/io/jsonwebtoken/impl/DefaultClock.java @@ -36,8 +36,12 @@ public class DefaultClock implements Clock { * * @return a new {@link Date} instance. */ - @Override public Date now() { - return new Date(); + return new Date(millis()); + } + + @Override + public long millis() { + return System.currentTimeMillis(); } } diff --git a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java b/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java index 6034b044b..3e21a3a24 100644 --- a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java +++ b/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java @@ -269,7 +269,7 @@ public Jwt parse(String jwt) throws ExpiredJwtException, MalformedJwtException, int delimiterCount = 0; - StringBuilder sb = new StringBuilder(128); + StringBuilder sb = new StringBuilder(jwt.length()); for (char c : jwt.toCharArray()) { @@ -421,26 +421,19 @@ public Jwt parse(String jwt) throws ExpiredJwtException, MalformedJwtException, } } - final boolean allowSkew = this.allowedClockSkewMillis > 0; - //since 0.3: if (claims != null) { - - final Date now = this.clock.now(); - long nowTime = now.getTime(); + final long nowTime = this.clock.millis(); //https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-30#section-4.1.4 //token MUST NOT be accepted on or after any specified exp time: Date exp = claims.getExpiration(); if (exp != null) { - - long maxTime = nowTime - this.allowedClockSkewMillis; - Date max = allowSkew ? new Date(maxTime) : now; - if (max.after(exp)) { + if (nowTime > exp.getTime() + this.allowedClockSkewMillis) { String expVal = DateFormats.formatIso8601(exp, false); - String nowVal = DateFormats.formatIso8601(now, false); + String nowVal = DateFormats.formatIso8601(new Date(nowTime), false); - long differenceMillis = maxTime - exp.getTime(); + long differenceMillis = nowTime - exp.getTime(); String msg = "JWT expired at " + expVal + ". Current time: " + nowVal + ", a difference of " + differenceMillis + " milliseconds. Allowed clock skew: " + @@ -454,13 +447,11 @@ public Jwt parse(String jwt) throws ExpiredJwtException, MalformedJwtException, Date nbf = claims.getNotBefore(); if (nbf != null) { - long minTime = nowTime + this.allowedClockSkewMillis; - Date min = allowSkew ? new Date(minTime) : now; - if (min.before(nbf)) { + if (nowTime < nbf.getTime() - this.allowedClockSkewMillis) { String nbfVal = DateFormats.formatIso8601(nbf, false); - String nowVal = DateFormats.formatIso8601(now, false); + String nowVal = DateFormats.formatIso8601(new Date(nowTime), false); - long differenceMillis = nbf.getTime() - minTime; + long differenceMillis = nbf.getTime() - nowTime; String msg = "JWT must not be accepted before " + nbfVal + ". Current time: " + nowVal + ", a difference of " + diff --git a/impl/src/main/java/io/jsonwebtoken/impl/FixedClock.java b/impl/src/main/java/io/jsonwebtoken/impl/FixedClock.java index 205035cec..cd124de89 100644 --- a/impl/src/main/java/io/jsonwebtoken/impl/FixedClock.java +++ b/impl/src/main/java/io/jsonwebtoken/impl/FixedClock.java @@ -27,14 +27,14 @@ */ public class FixedClock implements Clock { - private final Date now; + private final long now; /** * Creates a new fixed clock using new {@link Date Date}() as the seed timestamp. All calls to * {@link #now now()} will always return this seed Date. */ public FixedClock() { - this(new Date()); + this(System.currentTimeMillis()); } /** @@ -43,12 +43,20 @@ public FixedClock() { * * @param now the specified Date to always return from all calls to {@link #now now()}. */ - public FixedClock(Date now) { + public FixedClock(long now) { this.now = now; } - @Override + public FixedClock(Date now) { + this(now.getTime()); + } + public Date now() { + return new Date(millis()); + } + + @Override + public long millis() { return this.now; } } diff --git a/impl/src/test/groovy/io/jsonwebtoken/impl/FixedClockTest.groovy b/impl/src/test/groovy/io/jsonwebtoken/impl/FixedClockTest.groovy index 3e39f03fd..52966cb10 100644 --- a/impl/src/test/groovy/io/jsonwebtoken/impl/FixedClockTest.groovy +++ b/impl/src/test/groovy/io/jsonwebtoken/impl/FixedClockTest.groovy @@ -29,6 +29,6 @@ class FixedClockTest { Thread.sleep(100) def date2 = clock.now() - assertSame date1, date2 + assertEquals date1, date2 } }