[jira] [Created] (NET-746) FTP: Use char[] instead of String for sensitive data / login

["Gregor Scholtysik (Jira)" <ji...@apache.org>]

Gregor Scholtysik created NET-746:
-------------------------------------

             Summary: FTP: Use char[] instead of String for sensitive data / login
                 Key: NET-746
                 URL: https://issues.apache.org/jira/browse/NET-746
             Project: Commons Net
          Issue Type: Improvement
          Components: FTP
    Affects Versions: 3.13.0
            Reporter: Gregor Scholtysik


{{FTPClient#login}} uses {{String}} for password information. Instead, a {{char[]}} array should be provided and zeroed after transmitting the command to the buffer, e.g. using {{Arrays.fill(password, '\0')}}.

{{FTP#sendCommand}} and {{FTP#buildMessage}} should also have overloads for {{char[]}} messages (for callers like {{FTPClient#login}}) or operate on char arrays directly.

In {{FTP#send}}, {{java.io.BufferedWriter#write}} also accepts a {{char[]}} parameter, so there shouldn't be any compatibility issues here.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)