Do not throw away random bytes from the CSPRNG

The older code generated LEN bytes of cryptography-safe random data
and applied the base64 encoding on top of that. The base64
transformation, however, inflates the size of the data by 33%, and
this means that only 9 bytes of randomness were actually used.

Unless the goal was to discard some of the CSPRNG output to make sure
that we do not leak too much stuff to a possible attacker, of course
("attacker" == "user generating passwords"). If that is the case, let
me know and I'll send a patch clarifying that this is by design.

Change-Id: Ie90ccc8012b3f6b9f80b74b879b713bc6959a874

1 files changed, 2 insertions, 2 deletions

diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutHttpPassword.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutHttpPassword.java
index f7061e3738..2e0a91c179 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutHttpPassword.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutHttpPassword.java
@@ -124,8 +124,8 @@ public class PutHttpPassword implements RestModifyView<AccountResource, Input> {
     rng.nextBytes(rand);
 
     byte[] enc = Base64.encodeBase64(rand, false);
-    StringBuilder r = new StringBuilder(LEN);
-    for (int i = 0; i < LEN; i++) {
+    StringBuilder r = new StringBuilder(enc.length);
+    for (int i = 0; i < enc.length; i++) {
       if (enc[i] == '=') {
         break;
       }