- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
ID: java-security/bad-hexa-concatenation
Language: Java
Severity: Warning
Category: Security
CWE: 704
Using Integer.toHexString()
may trim leading zeroes and other missing information. This mistake weakens the hash value computed since it introduces more collisions. For example, the hash values “0x0123” and “0x1203” would both output as “123” for the above function.
class NotCompliant {
public void myMethod() {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] resultBytes = md.digest(password.getBytes("UTF-8"));
StringBuilder stringBuilder = new StringBuilder();
for(byte b :resultBytes) {
stringBuilder.append(Integer.toHexString( b & 0xFF ));
}
return stringBuilder.toString();
}
}
class NotCompliant {
public void myMethod() {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] resultBytes = md.digest(password.getBytes("UTF-8"));
StringBuilder stringBuilder = new StringBuilder();
for(byte b :resultBytes) {
stringBuilder.append( String.format( "%02X", b ) );
}
return stringBuilder.toString();
}
}
|
|
For more information, please read the Code Analysis documentation
Identify code vulnerabilities directly in yourVS Code editor
Identify code vulnerabilities directly inJetBrains products