CODEWITHSUNDEEP
javaarrayssecuritybytesonarqube
Some Java Guy
Some Java Guy

Reputation: 5118

Defensive copying help - Array is stored directly - Impact Analysis

I have fixed one Sonar security alert - Array is stored directly by

Initially

void setDerivedKey(byte[] derivedKey)
{
this.derivedKey = derivedKey;
}

To

void setDerivedKey (byte[] newDerivedKey)
{
if(newDerivedKey==null)
 {  this.derivedKey = new byte[0];          }
else
 {   this.derivedKey = Arrays.copyOf(newDerivedKey, newDerivedKey.length); }
}

How do I fix this

    public pEngine(byte[] salt) {
    byte[] mySalt = Arrays.copyOf(salt, salt.length);  //Edited as per below    answer
    this.parameters = new pParameters("SomeValue", "SomeValue2", salt, 100); }

What is the Impact of the fix on 

 Performance
 Memory management
 Functionality

Upvotes: 0

Views: 53

Answers (1)

Thom
Thom

Reputation: 15052

I'm not sure I understand. Why not:

public pEngine(byte[] salt) {
    byte[] mySalt = Arrays.copyOf(salt, salt.length);
    this.parameters = new pParameters("SomeValue", "SomeValue2", mySalt, 100);
}

Upvotes: 1

Related Questions