Heap Inspection Security Vulnerability

java security heap static-code-analysis checkmarx
Gaurav Sachdeva picture Gaurav Sachdeva · May 20, 2015 · Viewed 23.8k times · Source

I have run my java app against the checkmarx tool for security vulnerability and it is constantly giving an issue - Heap Inspection, for my password field for which I use a character array. It doesnt give any more explanation than just pointing out the declaration of the password field.

private char[] passwordLength;

Could anyone help me out here, what more can I look for resolving this?

Answer

Checkmarx Support picture Checkmarx Support · May 26, 2015

Heap Inspection is about sensitive information stored in the machine memory unencrypted, so that if an attacker performs a memory dump (for example, the Heartbleed bug), that information is compromised. Thus, simply holding that information makes it vulnerable.

One can mitigate this by storing such sensitive information in a secured manner, such as a GuardedString object instead of a String or a char array, or encrypting it and scrubbing the original short after.

For more information, see this CWE (describes C/C++ but same relevancy for Java).

Related questions

Java Error: "Your security settings have blocked a local application from running"

I'm trying to run this simple HelloWorld code written in Java from my browser (Chrome): public class HelloWorld extends JApplet { public void init() { try { SwingUtilities.invokeAndWait(new Runnable() { public void run() { JLabel lbl = new JLabel("Hello World"); add(lbl); } }); } catch (…

Read More
Why is char[] preferred over String for passwords?

In Swing, the password field has a getPassword() (returns char[]) method instead of the usual getText() (returns String) method. Similarly, I have come across a suggestion not to use String to handle passwords. Why does String pose a threat to …

Read More
How to retrieve a file from a server via SFTP?

I'm trying to retrieve a file from a server using SFTP (as opposed to FTPS) using Java. How can I do this?

Read More