Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://docs.pmd-code.org/latest/pmd_rules_java_security.html below:

Security | PMD Source Code Analyzer

Rules that flag potential security flaws.

Since: PMD 6.4.0

Priority: Medium (3)

Do not use hard coded values for cryptographic operations. Please store keys outside of source code.

This rule is defined by the following Java class: net.sourceforge.pmd.lang.java.rule.security.HardCodedCryptoKeyRule

Example(s):

public class Foo {
    void good() {
        SecretKeySpec secretKeySpec = new SecretKeySpec(Properties.getKey(), "AES");
    }

    void bad() {
        SecretKeySpec secretKeySpec = new SecretKeySpec("my secret here".getBytes(), "AES");
    }
}

Use this rule by referencing it:

<rule ref="category/java/security.xml/HardCodedCryptoKey" />

Since: PMD 6.3.0

Priority: Medium (3)

Do not use hard coded initialization vector in cryptographic operations. Please use a randomly generated IV.

This rule is defined by the following Java class: net.sourceforge.pmd.lang.java.rule.security.InsecureCryptoIvRule

Example(s):

public class Foo {
    void good() {
        SecureRandom random = new SecureRandom();
        byte iv[] = new byte[16];
        random.nextBytes(bytes);
    }

    void bad() {
        byte[] iv = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, };
    }

    void alsoBad() {
        byte[] iv = "secret iv in here".getBytes();
    }
}

Use this rule by referencing it:

<rule ref="category/java/security.xml/InsecureCryptoIv" />

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4