Fortify Code Scanning: Parivacy Violation: Heap Inspection Vulnerability Solutions

The vulnerability caused by the situation:

Store sensitive data can not be reliably remove data from memory manipulation system String object.

These data if you do not clear the memory after the use of sensitive data (such as passwords, social security numbers, credit card numbers, etc.), then stored in memory may leak. In general, String it is used for storing sensitive data, however, since the  String object is not changed, the user can only use the JVM garbage collector to remove from memory  String value. Unless there is insufficient JVM memory, otherwise the system is not required to run the garbage collector, so when the garbage collector runs is not guaranteed. If an application crashes occur, the application of a memory dump operation may cause leakage of sensitive data.

Char array is generally used instead of the sensitive data stored String.

In the process of storing the data, as long as the String object to be used (whether to store or used as a media converter), the vulnerability can occur.

Bo is the main encountered situations:

The first (put a char [] array into String String method used directly or may have a new String Vulnerability):

char[] decryptChars = DecryptString(splits[1]);//splits是一个String[]
resultValue = String.valueOf(decryptChars);//该行引发漏洞，返回值resultValue是字符串
//resultValue = new String(decryptChars);//同上，该方法同样引发漏洞
Arrays.fill(decryptChars,' ');
if (resultValue == null) {
     throw new Exception("解密字符串失败！");
}
    

Modified:

char[] decryptChars = DecryptString(splits[1]);
StringBuffer sb = new StringBuffer();
for (int i = 0;i < decryptChars.length;i++){
    sb.append(decryptChars[i]);
}
Arrays.fill(decryptChars,' ');
if (sb.length()==0){
    throw new Exception("解密字符串失败！");
}

The second (the one byte [] is converted to char []):

byte[] bytes = HexToByte(sEncrypted);//sEncrypted是一个字符串
byte[] deBytes = DecryptStream(bytes);//加密
sDecryptChar = new String(deBytes,"ISO-8859-1");//引发漏洞，sDecryptChar是一个char[]

Modified:

import java.nio.ByteBuffer;
import java.nio.CharBuffer;
import java.nio.charset.Charset;

byte[] bytes = HexToByte(sEncrypted);
byte[] deBytes = DecryptStream(bytes);
Charset cs = Charset.forName("ISO-8859-1");
ByteBuffer bb = ByteBuffer.allocate(deBytes.length);
bb.put(bytes).flip();
CharBuffer cb = cs.decode(bb);
sDecryptChar = cb.array();