gideonlegrange / haveibeenpwned Goto Github PK

It would be awesome if you adapt this library to support Android 16+
Optional classes and java.util.stream are supported from Android API level 24+ , can you make an workaround to support older versions too ?

Thanks for the good work

Hi !

I'm currently trying to use this wrapper, I used the example code to try it out, but when I instantiate my HaveIBeenPwndApi class, this error shows up.

Exception in thread "main" java.lang.NoSuchMethodError: okhttp3.HttpUrl.get(Ljava/lang/String;)Lokhttp3/HttpUrl;
at retrofit2.Retrofit$Builder.baseUrl(Retrofit.java:458)
at me.legrange.haveibeenpwned.HaveIBeenPwndApi.(HaveIBeenPwndApi.java:59)
at me.legrange.haveibeenpwned.HaveIBeenPwndApi.(HaveIBeenPwndApi.java:41)
...

Code » HaveIBeenPwndApi hibp = new HaveIBeenPwndApi();
Running the program in a git bash window.
Using Windows 10, Java 8, imported the depend using Maven.

Looking forward for an answer,
Maxx_.

Have I Been Pwned added a new privacy feature: padding. See https://haveibeenpwned.com/API/v3#PwnedPasswordsPadding Can we add it here?

Here is the top of a sample stack trace that we have been seeing on some of our production systems that are making a call into the isPlainPasswordPwned method:

java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
	at me.legrange.haveibeenpwned.HaveIBeenPwndApi.lambda$searchByRange$2(HaveIBeenPwndApi.java:179)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:992)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at me.legrange.haveibeenpwned.HaveIBeenPwndApi.searchByRange(HaveIBeenPwndApi.java:180)
	at me.legrange.haveibeenpwned.HaveIBeenPwndApi.isHashPasswordPwned(HaveIBeenPwndApi.java:221)
	at me.legrange.haveibeenpwned.HaveIBeenPwndApi.isPlainPasswordPwned(HaveIBeenPwndApi.java:209)

The issue here seems to be that the searchByRange helper method is getting input from the remote API, and in each line of the response it receives it is splitting the line based on a : delimiter character. It does not check the input that it has split before indexing into splitResult[1] .

If the code within searchByRange were tweaked to be a little bit more defensive about malformed input and exclude lines that seem to be malformed in this way from the result this problem would disappear.

Not an immediate problem for us -- we can look for the ArrayIndexOutOfBoundsException and catch it separately -- but it seems like a bug worth fixing. And we'll be happy to take the dependency on the new library version if it were fixed. Thanks!

Can you make it possible to change the URL for Have I Been Pwned in the client library for testing purposes? I want to be able to switch it to a proxy server, so I can test what happens if the server goes down or times out. Thanks!