From c8e9b508838d72b5c3e87eb32dbee53f45a80254 Mon Sep 17 00:00:00 2001
From: Xiao <103391432+QXIoa@users.noreply.github.com>
Date: Tue, 14 Jul 2026 16:03:52 -0400
Subject: [PATCH] fix leak (#43)

- add SLF4J as a dependency in pom.xml
- replace System.out.println with log.warn (prevent leak)
---
 pom.xml                                                   | 6 ++++++
 src/main/java/de/caydenno1/xacrypto/hash/sha/SHA0.java    | 7 +++++--
 .../java/de/caydenno1/xacrypto/zekerrijndael/GCM/GCM.java | 6 +++++-
 .../xacrypto/zekerrijndael/GCM/ciphers/AESGCM.java        | 8 ++++++--
 4 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/pom.xml b/pom.xml
index b5a4db1..727a23d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,6 +55,12 @@
     </dependencyManagement>
 
     <dependencies>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+            <version>2.0.16</version>
+        </dependency>
+
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter-api</artifactId>
diff --git a/src/main/java/de/caydenno1/xacrypto/hash/sha/SHA0.java b/src/main/java/de/caydenno1/xacrypto/hash/sha/SHA0.java
index a0a41f1..740504b 100644
--- a/src/main/java/de/caydenno1/xacrypto/hash/sha/SHA0.java
+++ b/src/main/java/de/caydenno1/xacrypto/hash/sha/SHA0.java
@@ -1,6 +1,8 @@
 package de.caydenno1.xacrypto.hash.sha;
 
 import de.caydenno1.xacrypto.misc.Constants;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.nio.charset.StandardCharsets;
 
@@ -8,9 +10,10 @@ import static de.caydenno1.xacrypto.hash.sha.Shared.INT2BYTE;
 import static de.caydenno1.xacrypto.hash.sha.Shared.hex;
 
 public class SHA0 {
-    // we really only need one file. very simple code
+    private static final Logger log = LoggerFactory.getLogger(SHA0.class);
+
     public static byte[] hash(byte[] data){
-        System.out.println("Beware, SHA0 is deprecated and cryptographically broken. Use at your own risk.");
+        log.warn("SHA0 is deprecated and cryptographically broken. Use at your own risk.");
         byte[] padded = Shared.pad(data);
 
         int a0 = Constants.SHA_H[0], a1 = Constants.SHA_H[1], a2 = Constants.SHA_H[2], a3 = Constants.SHA_H[3], a4 = Constants.SHA_H[4];
diff --git a/src/main/java/de/caydenno1/xacrypto/zekerrijndael/GCM/GCM.java b/src/main/java/de/caydenno1/xacrypto/zekerrijndael/GCM/GCM.java
index a9c4764..2662fda 100644
--- a/src/main/java/de/caydenno1/xacrypto/zekerrijndael/GCM/GCM.java
+++ b/src/main/java/de/caydenno1/xacrypto/zekerrijndael/GCM/GCM.java
@@ -1,12 +1,16 @@
 package de.caydenno1.xacrypto.zekerrijndael.GCM;
+
 import de.caydenno1.xacrypto.misc.ToM;
 import de.caydenno1.xacrypto.misc.XACryptoException;
 import de.caydenno1.xacrypto.misc.isNull;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.util.Arrays;
 import java.util.Objects;
 
 public class GCM {
+    private static final Logger log = LoggerFactory.getLogger(GCM.class);
     private final BlockCipher cip;
     private final GHASH gh;
 
@@ -63,7 +67,7 @@ public class GCM {
         if (!corr && !override) {
             throw new XACryptoException("GCM tag does not match. Use Flag -override to ignore this.",(byte)-1);
         } else if (!corr) {
-            System.out.println("GCM tag does not match. Overriding...");
+            log.warn("GCM tag does not match. Overriding...");
         }
 
         return gctr(inc32(J0), ct);
diff --git a/src/main/java/de/caydenno1/xacrypto/zekerrijndael/GCM/ciphers/AESGCM.java b/src/main/java/de/caydenno1/xacrypto/zekerrijndael/GCM/ciphers/AESGCM.java
index 716d8ee..9a22d71 100644
--- a/src/main/java/de/caydenno1/xacrypto/zekerrijndael/GCM/ciphers/AESGCM.java
+++ b/src/main/java/de/caydenno1/xacrypto/zekerrijndael/GCM/ciphers/AESGCM.java
@@ -4,6 +4,8 @@ import de.caydenno1.xacrypto.misc.XACryptoException;
 import de.caydenno1.xacrypto.zekerrijndael.GCM.GHASH;
 import de.caydenno1.xacrypto.zekerrijndael.GCM.AES;
 import de.caydenno1.xacrypto.zekerrijndael.GCM.Result;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.util.Objects;
 
@@ -16,8 +18,10 @@ interface AESCipher {
 }
 
 public class AESGCM implements AESCipher {
+    private static final Logger log = LoggerFactory.getLogger(AESGCM.class);
+
     public Result encryptBlock(byte[] pln, byte[] key, byte[] nonce, byte[] aad) throws XACryptoException {
-        System.out.println("WARNING! AESGCM may not be fully functional and partially broken. I am unsure if it fully works or not.");
+        log.warn("AESGCM may not be fully functional and partially broken. I am unsure if it fully works or not.");
         AES aes = new AES(key, getKeySize(key));
         byte[] H = aes.encryptBlock(new byte[16]);
         GHASH gh = new GHASH(H);
@@ -82,7 +86,7 @@ public class AESGCM implements AESCipher {
         if (!ToM(tag, expectedTag) && !flag) {
             throw new XACryptoException("Tag does not match. USE flag \"-override\" to ignore this.");
         } else if (!ToM(tag,expectedTag) && flag) {
-            System.out.println("Continuing in insecure mode.");
+            log.warn("Continuing in insecure mode.");
         }
 
         return aes.encryptCTR(cip, J0);