ishangsf/rspec
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply review suggestions

Browse Source
This commit is contained in:
Pierre-Loup 2025-03-24 15:35:36 +01:00
parent 285fbcc0b0
commit cbf996ca67
No known key found for this signature in database
2 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rules/S5344/java/how-to-fix-it/java-cryptography-extension.adoc
View File

@ -4,10 +4,9 @@
==== Noncompliant code example ==== Noncompliant code example
The following code is vulnerable because it uses a legacy digest-based password The derived key is vulnerable because the cost factor (rounds) is too low for the chosen algorithm.
encoding that is not considered secure.
[source,kotlin,diff-id=1,diff-type=noncompliant] [source,java,diff-id=11,diff-type=noncompliant]
---- ----
private SecretKey deriveKey(String password, byte[] salt) throws Exception { private SecretKey deriveKey(String password, byte[] salt) throws Exception {
PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt, 120000, 256); // Noncompliant PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt, 120000, 256); // Noncompliant
@ -18,7 +17,7 @@ private SecretKey deriveKey(String password, byte[] salt) throws Exception {
==== Compliant solution ==== Compliant solution
[source,kotlin,diff-id=1,diff-type=compliant] [source,javan,diff-id=11,diff-type=compliant]
---- ----
private SecretKey deriveKey(String password, byte[] salt) throws Exception { private SecretKey deriveKey(String password, byte[] salt) throws Exception {
PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt, 210000, 256); PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt, 210000, 256);

4
rules/S5344/java/how-to-fix-it/spring.adoc
View File

@ -7,7 +7,7 @@
The following code is vulnerable because it uses a legacy digest-based password The following code is vulnerable because it uses a legacy digest-based password
encoding that is not considered secure. encoding that is not considered secure.
[source,java,diff-id=1,diff-type=noncompliant] [source,java,diff-id=12,diff-type=noncompliant]
---- ----
@Autowired @Autowired
public void configureGlobal(AuthenticationManagerBuilder auth, DataSource dataSource) throws Exception { public void configureGlobal(AuthenticationManagerBuilder auth, DataSource dataSource) throws Exception {
@ -20,7 +20,7 @@ public void configureGlobal(AuthenticationManagerBuilder auth, DataSource dataSo
==== Compliant solution ==== Compliant solution
[source,java,diff-id=1,diff-type=compliant] [source,java,diff-id=12,diff-type=compliant]
---- ----
@Autowired @Autowired
public void configureGlobal(AuthenticationManagerBuilder auth, DataSource dataSource) throws Exception { public void configureGlobal(AuthenticationManagerBuilder auth, DataSource dataSource) throws Exception {