Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: mitigate storing password in the memory #2858

Merged
merged 24 commits into from Apr 13, 2023

Conversation

pj892031
Copy link
Contributor

@pj892031 pj892031 commented Mar 31, 2023

Description

In Java is a known issue that passwords stored as String are not under control. It can be minimized by using char arrays instead of String. It will not completely solve the issue, just reduce it a little bit. This PR changes the password stored as a string into array of chars where possible.

Type of change

Please delete options that are not relevant.

  • (fix) Bug fix (non-breaking change which fixes an issue)
  • (refactor) Refactor the code

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas. In JS I did provide JSDoc
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • The java tests in the area I was working on leverage @nested annotations
  • Any dependent changes have been merged and published in downstream modules

Signed-off-by: Pavel Jareš <pavel.jares@broadcom.com>
Signed-off-by: Pavel Jareš <pavel.jares@broadcom.com>
Signed-off-by: Pavel Jareš <pavel.jares@broadcom.com>
@github-actions github-actions bot added the Sensitive Sensitive change that requires peer review label Mar 31, 2023
pj892031 and others added 4 commits March 31, 2023 14:53
Signed-off-by: Pavel Jareš <pavel.jares@broadcom.com>
Signed-off-by: Pavel Jareš <pavel.jares@broadcom.com>
Signed-off-by: Pavel Jareš <pavel.jares@broadcom.com>
@achmelo achmelo marked this pull request as ready for review April 3, 2023 10:53
pablocarle and others added 4 commits April 3, 2023 15:37
Signed-off-by: Pablo Hernán Carle <pablo.carle@broadcom.com>
it
Signed-off-by: Pablo Hernán Carle <pablo.carle@broadcom.com>
Signed-off-by: Pablo Hernán Carle <pablo.carle@broadcom.com>
achmelo and others added 2 commits April 4, 2023 08:59
Signed-off-by: achmelo <a.chmelo@gmail.com>
Signed-off-by: Pablo Hernán Carle <pablo.carle@broadcom.com>
Pablo Hernán Carle and others added 4 commits April 4, 2023 16:05
Signed-off-by: Pablo Hernán Carle <pablo.carle@broadcom.com>
Signed-off-by: Pablo Hernán Carle <pablo.carle@broadcom.com>
@pablocarle pablocarle changed the title Mitigate storing password in the memory fixMitigate storing password in the memory Apr 5, 2023
@pablocarle pablocarle changed the title fixMitigate storing password in the memory fix: mitigate storing password in the memory Apr 5, 2023
Signed-off-by: Pablo Hernán Carle <pablo.carle@broadcom.com>
Signed-off-by: Pablo Hernán Carle <pablo.carle@broadcom.com>
build.gradle Show resolved Hide resolved
Signed-off-by: Pavel Jareš <pavel.jares@broadcom.com>
@sonarcloud
Copy link

sonarcloud bot commented Apr 13, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 3 Code Smells

86.2% 86.2% Coverage
0.0% 0.0% Duplication

Copy link
Contributor

@JirkaAichler JirkaAichler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good

@pj892031 pj892031 merged commit b1596eb into v2.x.x Apr 13, 2023
33 checks passed
@delete-merged-branch delete-merged-branch bot deleted the reboot/mitigateStoringPassword branch April 13, 2023 16:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Sensitive Sensitive change that requires peer review
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants