问题
I have run my java app against the checkmarx tool for security vulnerability and it is constantly giving an issue - Heap Inspection, for my password field for which I use a character array. It doesnt give any more explanation than just pointing out the declaration of the password field.
private char[] passwordLength;
Could anyone help me out here, what more can I look for resolving this?
回答1:
Heap Inspection is about sensitive information stored in the machine memory unencrypted, so that if an attacker performs a memory dump (for example, the Heartbleed bug), that information is compromised. Thus, simply holding that information makes it vulnerable.
One can mitigate this by storing such sensitive information in a secured manner, such as a GuardedString object instead of a String or a char array, or encrypting it and scrubbing the original short after.
For more information, see this CWE (describes C/C++ but same relevancy for Java).
回答2:
See this answer on security.stackexchange.com for the question "Is it more secure to overwrite the value char[] in a String".
TLDR: You can't do much about it.
PS: As that is a sister stackexchange site, I am not copying the answer here (also, it is too long). If a moderator disagrees, fell free to copy/paste it.
回答3:
Example approach to store secret information in JVM memory
IMHO you should use a SealedObject to store credential data encrypted inside your JVM memory.
You need following packages:
- java.security.SecureRandom
- javax.crypto.Cipher
- javax.crypto.KeyGenerator
- javax.crypto.SealedObject
- javax.crypto.SecretKey
So you create
- an initialized key generator which creates a secret key
- a cipher which is initialized by key and a secure random
- then you create a new sealed object using the cipher
- all storage and (temporary) loading of your credentials are done to/from the sealed object which replaces your char array.
A working example can be found at: https://github.com/Daimler/sechub/blob/develop/sechub-adapter/src/main/java/com/daimler/sechub/adapter/CryptoAccess.java
来源：https://stackoverflow.com/questions/30341327/heap-inspection-security-vulnerability