Fix: fix older passwords breaking

Author: PranavPurwar

app/build.gradle.kts

@@ -14,8 +14,8 @@ android {
         applicationId = "dev.pranav.applock"
         minSdk = 26
         targetSdk = 37
-        versionCode = 250
-        versionName = "2.5.0"
+        versionCode = 251
+        versionName = "2.5.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }

app/src/main/java/dev/pranav/applock/core/utils/SecurityUtils.kt

@@ -1,32 +1,37 @@
 package dev.pranav.applock.core.utils
 
 import android.util.Base64
+import dev.pranav.applock.core.utils.SecurityUtils.MAX_PASSWORD_LENGTH
 import java.security.MessageDigest
 import java.security.SecureRandom
 
 object SecurityUtils {
 
     private const val HASH_ALGORITHM = "SHA-256"
     private const val SALT_LENGTH = 16
-    private const val MAX_PASSWORD_LENGTH = 64
+    const val MAX_PASSWORD_LENGTH = 64
 
     /**
      * Sanitizes the input string by filtering out control characters and null bytes.
      * Also limits the length to [MAX_PASSWORD_LENGTH].
      */
     fun sanitizePassword(input: String): String {
-        return input.filter { it.code >= 32 && it.code != 127 }
+        return input
+            .filter { it.code >= 32 && it.code != 127 }
             .take(MAX_PASSWORD_LENGTH)
     }
 
     /**
      * Generates a random cryptographic salt.
      */
     fun generateSalt(): ByteArray {
-        val random = SecureRandom()
-        val salt = ByteArray(SALT_LENGTH)
-        random.nextBytes(salt)
-        return salt
+        return ByteArray(SALT_LENGTH).also { salt ->
+            SecureRandom().nextBytes(salt)
+        }
+    }
+
+    fun hashPassword(password: String): String {
+        return hashPassword(password, generateSalt())
     }
 
     /**
@@ -35,35 +40,51 @@ object SecurityUtils {
      * Format: salt:hash
      */
     fun hashPassword(password: String, salt: ByteArray): String {
+        val sanitizedPassword = sanitizePassword(password)
+
         val md = MessageDigest.getInstance(HASH_ALGORITHM)
         md.update(salt)
-        val hashedPassword = md.digest(password.toByteArray(Charsets.UTF_8))
-        
+        val hash = md.digest(sanitizedPassword.toByteArray(Charsets.UTF_8))
+
         val saltBase64 = Base64.encodeToString(salt, Base64.NO_WRAP)
-        val hashBase64 = Base64.encodeToString(hashedPassword, Base64.NO_WRAP)
-        
+        val hashBase64 = Base64.encodeToString(hash, Base64.NO_WRAP)
+
         return "$saltBase64:$hashBase64"
     }
 
+    fun isSaltedHash(value: String): Boolean {
+        val parts = value.split(":")
+        if (parts.size != 2) return false
+
+        return try {
+            Base64.decode(parts[0], Base64.NO_WRAP)
+            Base64.decode(parts[1], Base64.NO_WRAP)
+            true
+        } catch (_: Exception) {
+            false
+        }
+    }
+
     /**
      * Verifies an input password against a stored salted hash string.
      */
     fun verifyPassword(inputPassword: String, storedSaltedHash: String): Boolean {
         return try {
             val parts = storedSaltedHash.split(":")
             if (parts.size != 2) return false
-            
-            val salt = Base64.decode(parts[0], Base64.DEFAULT)
-            val storedHash = parts[1]
-            
+
+            val salt = Base64.decode(parts[0], Base64.NO_WRAP)
+            val expectedHash = Base64.decode(parts[1], Base64.NO_WRAP)
+
+            val sanitizedInput = sanitizePassword(inputPassword)
+
             val md = MessageDigest.getInstance(HASH_ALGORITHM)
             md.update(salt)
-            val inputHashed = md.digest(inputPassword.toByteArray(Charsets.UTF_8))
-            val inputHashBase64 = Base64.encodeToString(inputHashed, Base64.NO_WRAP)
-            
-            inputHashBase64 == storedHash
-        } catch (e: Exception) {
+            val actualHash = md.digest(sanitizedInput.toByteArray(Charsets.UTF_8))
+
+            MessageDigest.isEqual(actualHash, expectedHash)
+        } catch (_: Exception) {
             false
         }
     }
-}
+}

app/src/main/java/dev/pranav/applock/data/repository/PreferencesRepository.kt

@@ -1,9 +1,9 @@
 package dev.pranav.applock.data.repository
 
-import dev.pranav.applock.core.utils.SecurityUtils
 import android.content.Context
 import android.content.SharedPreferences
 import androidx.core.content.edit
+import dev.pranav.applock.core.utils.SecurityUtils
 
 /**
  * Repository for managing application preferences and settings.
@@ -27,14 +27,22 @@ class PreferencesRepository(context: Context) {
         return appLockPrefs.getString(KEY_PASSWORD, null)
     }
 
-    fun validatePassword(inputPassword: String): Boolean {
-        val storedSaltedHash = getPassword() ?: return false
-        
-        // If it's a legacy plain text password (doesn't contain ':'), migrate it or validate as is
-        // For simplicity and since this is a new feature, we assume all passwords should be hashed.
-        // If there's an existing plain text password, this will fail validation and require reset.
-        
-        return SecurityUtils.verifyPassword(inputPassword, storedSaltedHash)
+    fun validatePassword(input: String): Boolean {
+        val stored = getPassword()
+        if (stored.isNullOrBlank()) return false
+
+        val sanitizedInput = SecurityUtils.sanitizePassword(input)
+
+        if (SecurityUtils.isSaltedHash(stored)) {
+            return SecurityUtils.verifyPassword(sanitizedInput, stored)
+        }
+
+        if (stored == input || stored == sanitizedInput) {
+            setPassword(sanitizedInput)
+            return true
+        }
+
+        return false
     }
 
     fun setPattern(pattern: String) {

fastlane/metadata/android/en-US/changelogs/251.txt

@@ -0,0 +1,2 @@
+* fix previous passwords breaking
+* fix password screen showing again on back press