Allow configuration of a max password length and default to 1024 (#568)

Author: kevinherron

build-tools/src/main/resources/milo/checkstyle.xml

@@ -215,5 +215,9 @@
             <property name="exceptionVariableName" value="expected"/>
         </module>
         <module name="CommentsIndentation"/>
+        <module name="SuppressionCommentFilter">
+            <property name="offCommentFormat" value="@formatter\:off"/>
+            <property name="onCommentFormat" value="@formatter\:on"/>
+        </module>
     </module>
 </module>

opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/api/config/OpcUaServerConfigLimits.java

@@ -83,6 +83,15 @@ default Double getMaxSupportedSampleRate() {
         return (double) TimeUnit.MILLISECONDS.convert(24, TimeUnit.HOURS);
     }
 
+    /**
+     * Get the maximum allowed password length.
+     *
+     * @return the maximum allowed password length.
+     */
+    default UInteger getMaxPasswordLength() {
+        return uint(1024);
+    }
+
     //region ServerCapabilities
 
     default Double getMinSupportedSampleRate() {

opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/identity/UsernameIdentityValidator.java

@@ -103,12 +103,29 @@ private String validateUserNameIdentityToken(
         if (algorithm != SecurityAlgorithm.None) {
             byte[] plainTextBytes = decryptTokenData(session, algorithm, tokenBytes);
 
-            int length = ((plainTextBytes[3] & 0xFF) << 24) |
-                ((plainTextBytes[2] & 0xFF) << 16) |
-                ((plainTextBytes[1] & 0xFF) << 8) |
-                (plainTextBytes[0] & 0xFF);
+            //@formatter:off
+            long length =
+                ((plainTextBytes[3] & 0xFFL) << 24) |
+                ((plainTextBytes[2] & 0xFFL) << 16) |
+                ((plainTextBytes[1] & 0xFFL) <<  8) |
+                ( plainTextBytes[0] & 0xFFL       );
+            //@formatter:on
+
+            if (length != plainTextBytes.length - 4) {
+                throw new UaException(StatusCodes.Bad_IdentityTokenInvalid, "invalid token data");
+            }
+
+            int passwordLength = (int) length - lastNonceLength;
+
+            if (passwordLength < 0) {
+                throw new UaException(StatusCodes.Bad_IdentityTokenInvalid, "invalid password length");
+            }
+
+            if (passwordLength > session.getServer().getConfig().getLimits().getMaxPasswordLength().longValue()) {
+                throw new UaException(StatusCodes.Bad_EncodingLimitsExceeded, "password length exceeds limits");
+            }
 
-            byte[] passwordBytes = new byte[length - lastNonceLength];
+            byte[] passwordBytes = new byte[passwordLength];
             byte[] nonceBytes = new byte[lastNonceLength];
 
             System.arraycopy(plainTextBytes, 4, passwordBytes, 0, passwordBytes.length);