OWASP / OWASP/SecurityShepherd

Heap Inspection - Password Stored in String

Open
#446 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug
Dominant language
Java
Stars
1.5k
Forks
515
Avg merge
3h 46m
Merged PRs (30d)
1

Description

https://github.com/OWASP/SecurityShepherd/blob/653843e89f9456caf6b13d1fc68d1b02c3f81260/src/main/java/dbProcs/Database.java#L78

We should change this so that it's stored in a char[]

Example usage;

class StoreSensitiveData{
    private char[] sensitiveData;

    //use the data
    public void store(){
        try{...}
        catch(IOException e){...}
        finally{wipe()}
    }

    //wipe data
    public void wipe() {
        if (sensitiveData != null) {
            Arrays.fill(sensitiveData, '*');
        };
        sensitiveData = null;
    }
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open src/main/java/dbProcs/Database.java at line 78 and inspect how the password is stored and used. Change the storage to follow the issue's char[] example, ensuring the existing database flow still works and the sensitive value can be wiped afterward; verify the affected Java code builds or its relevant tests pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.