You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "David Graff (JIRA)" <ji...@apache.org> on 2013/04/02 17:31:15 UTC
[jira] [Comment Edited] (HTTPCLIENT-1329) SSLSocketFactory
keystorePassword constructor parameter should be char[] instead of
java.lang.String
[ https://issues.apache.org/jira/browse/HTTPCLIENT-1329?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13606815#comment-13606815 ]
David Graff edited comment on HTTPCLIENT-1329 at 4/2/13 3:29 PM:
-----------------------------------------------------------------
Sebb, great comment on that. My only concern with doing that is that should be up to the developer calling it to clear that.
Would it be advisable to have a key password in addition to the store password?
was (Author: djgraff):
Sebb, great comment on that. My only concern with doing that is that should be up to the implementer calling it to clear that.
Would it be advisable to have a key password in addition to the store password?
> SSLSocketFactory keystorePassword constructor parameter should be char[] instead of java.lang.String
> ----------------------------------------------------------------------------------------------------
>
> Key: HTTPCLIENT-1329
> URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1329
> Project: HttpComponents HttpClient
> Issue Type: Improvement
> Components: HttpClient
> Affects Versions: 4.2.2
> Reporter: David Graff
> Labels: ssl
> Fix For: 4.3 Alpha2
>
>
> The constructor signatures for creating an SSLSocketFactory take a java.lang.String as a parameter. This can lead to potential attack vectors because the password will be stored within the string pool of the VM. As a suggestion, in a future version, deprecate this API and add a signature taking a char[] parameter. This way the value of the password will not be cached for an excessive duration and will be garbage collected when out of reference.
> This is based on recommendations from the GIAC Secure Software Programmer for Java course.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org