Conversation
|
Hi, Hope to hear any feedback from you! |
| */ | ||
| public static MessageDigest getDigest(final String algorithm, final MessageDigest defaultMessageDigest) { | ||
| try { | ||
| /** potential insecure algorithm (MD2, MD5, SHA1, SHA256) called here */ |
There was a problem hiding this comment.
@YYTVicky
This would better done in the method Javadoc for the algorithm param.
There was a problem hiding this comment.
Hi @garydgregory , Thanks a lot for your kind reply, we are a security research team at Virginia Tech. We are doing an empirical study about the usefulness of the existing security vulnerability detection tools. May we follow up on several questions:
Is the bug report helpful?
will you prefer to fix the reported vulnerability
Are there any types of bugs/security vulnerabilities you want the detection tools to pay more attention to?
Appreciate any feedback from your side!
There was a problem hiding this comment.
"Is the bug report helpful?"
No because it ignores documented behavior, I consider it a false positive.
|
Closing, no further input from OP. |
3 participants
No description provided.