Checking sec-websocket-accept against expected instead of actual. Issue #295

jpwsutton · jpwsutton · commit 8ce431bd80c0 · 2017-01-23T11:11:00.000Z
Signed-off-by: James Sutton &lt;james.sutton@uk.ibm.com&gt;
diff --git a/org.eclipse.paho.client.mqttv3/src/main/java/org/eclipse/paho/client/mqttv3/internal/websocket/WebSocketHandshake.java b/org.eclipse.paho.client.mqttv3/src/main/java/org/eclipse/paho/client/mqttv3/internal/websocket/WebSocketHandshake.java
@@ -197,7 +197,7 @@ private void verifyWebSocketKey(String key, String accept) throws NoSuchAlgorith
 		// then we check that the response is the same.
 		byte[] sha1Bytes = sha1(key + ACCEPT_SALT);
 		String encodedSha1Bytes = Base64.encodeBytes(sha1Bytes).trim();
-		if(!encodedSha1Bytes.equals(encodedSha1Bytes)){
+		if(!encodedSha1Bytes.equals(accept.trim())){
 			throw new HandshakeFailedException();
 		}	
 	}

Original file line number	Diff line number	Diff line change
`@@ -197,7 +197,7 @@ private void verifyWebSocketKey(String key, String accept) throws NoSuchAlgorith`
`197`	`197`	`// then we check that the response is the same.`
`198`	`198`	`byte[] sha1Bytes = sha1(key + ACCEPT_SALT);`
`199`	`199`	`String encodedSha1Bytes = Base64.encodeBytes(sha1Bytes).trim();`
`200`		`- if(!encodedSha1Bytes.equals(encodedSha1Bytes)){`
	`200`	`+ if(!encodedSha1Bytes.equals(accept.trim())){`
`201`	`201`	`throw new HandshakeFailedException();`
`202`	`202`	`}`
`203`	`203`	`}`