Skip to content

[Bug] ApiUtils.md5hash discards leading 0s on hash (AKA: login failures via Fever integration) #348

@campbellr

Description

@campbellr

Describe the bug

When a user happens to be unlucky enough to have Fever credentials where the username + ":" + password happen to result in an MD5 hash with leading zeros, they are unable to log in via the Readrops app.

After a bit of digging, this seems to be because of an incorrect hash implementation in ApiUtils.md5hash:

fun md5hash(value: String): String {
val bytes = MessageDigest.getInstance("MD5")
.digest(value.toByteArray())
return BigInteger(1, bytes).toString(16)
)

It turns out that BigInteger.toString(16) doesn't preserve leading zeros, so an invalid API key is generated, and the user cannot login.

I believe the following diff would fix it, but I'm not familiar with Kotlin, but it works in this kotlin playground example:

diff --git a/api/src/main/java/com/readrops/api/utils/ApiUtils.kt b/api/src/main/java/com/readrops/api/utils/ApiUtils.kt
index c879c56a..52d0b931 100644
--- a/api/src/main/java/com/readrops/api/utils/ApiUtils.kt
+++ b/api/src/main/java/com/readrops/api/utils/ApiUtils.kt
@@ -48,7 +48,7 @@ object ApiUtils {
         val bytes = MessageDigest.getInstance("MD5")
                 .digest(value.toByteArray())
 
-        return BigInteger(1, bytes).toString(16)
+        return BigInteger(1, bytes).toString(16).padStart(32, '0')
     }
 
     fun handleRssSpecialCases(url: String): String {

To Reproduce
Steps to reproduce the behavior:

  1. Create a set of Fever credentials in Miniflux that result in a hash with leading zeros (eg: user4013:pass4013 which hashes to 0003296c0fa9a2bad56701b3fff82f21
  2. Attempt to set up a new Fever account in Readrops with the same credentials
  3. Clicking validate will fail
  4. See error

Expected behavior

I expect to be able to log in

Environment information (please complete the following information):

  • Account type: Fever (via Miniflux, in my case)
  • App version: 2.1.1
  • Android version: Android 16
  • Device type: Pixel 8a
  • Store: F-Droid

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions