From 3597db8e13f8fd5ef5309b31ef55eb8121663a6b Mon Sep 17 00:00:00 2001
From: Anders Hammar <anders@hammar.net>
Date: Tue, 2 Jan 2024 04:09:22 +0100
Subject: [PATCH] [JENKINS-72466] Upgrade jbcrypt dependency (#8811)

JENKINS-72466: Upgrades jbcrypt dependency
---
 bom/pom.xml                                            |  4 ++--
 core/pom.xml                                           |  2 +-
 .../security/HudsonPrivateSecurityRealmTest.java       | 10 +++++++++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index a4c8690015..53ac85bdaa 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -196,9 +196,9 @@ THE SOFTWARE.
         <version>${groovy.version}</version>
       </dependency>
       <dependency>
-        <groupId>org.connectbot.jbcrypt</groupId>
+        <groupId>org.connectbot</groupId>
         <artifactId>jbcrypt</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.2</version>
       </dependency>
       <dependency>
         <!-- Groovy shell uses this, but it doesn't declare the dependency -->
diff --git a/core/pom.xml b/core/pom.xml
index 4553986596..82d3b76bbb 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -282,7 +282,7 @@ THE SOFTWARE.
       <artifactId>groovy-all</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.connectbot.jbcrypt</groupId>
+      <groupId>org.connectbot</groupId>
       <artifactId>jbcrypt</artifactId>
     </dependency>
     <dependency>
diff --git a/core/src/test/java/hudson/security/HudsonPrivateSecurityRealmTest.java b/core/src/test/java/hudson/security/HudsonPrivateSecurityRealmTest.java
index 9d7e2b7b59..09aab39cb0 100644
--- a/core/src/test/java/hudson/security/HudsonPrivateSecurityRealmTest.java
+++ b/core/src/test/java/hudson/security/HudsonPrivateSecurityRealmTest.java
@@ -55,7 +55,7 @@ public class HudsonPrivateSecurityRealmTest {
      * or slow hardware, so this is commented out but left for ease of running locally when desired.
      */
     //@Test
-    public void timingBcrypt() {
+    public void timingJBCrypt() {
         // ignore the salt generation - check just matching....
         JBCryptEncoder encoder = new JBCryptEncoder();
         String encoded = encoder.encode("thisIsMyPassword1");
@@ -143,4 +143,12 @@ public class HudsonPrivateSecurityRealmTest {
             assertThrows(RuntimeException.class, () -> pbkdf2PasswordEncoder.matches("MySecurePassword", PBKDF2_HMAC_SHA512_ENCODED_PASSWORD));
         }
     }
+
+    @Test
+    public void testJBCryptPasswordMatching() {
+        JBCryptEncoder encoder = new JBCryptEncoder();
+        String encoded = encoder.encode("thisIsMyPassword");
+        assertTrue(encoder.matches("thisIsMyPassword", encoded));
+        assertFalse(encoder.matches("thisIsNotMyPassword", encoded));
+    }
 }