ishangsf/rspec
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply review suggestions

Browse Source
This commit is contained in:
Pierre-Loup 2025-03-24 15:35:36 +01:00
parent 285fbcc0b0
commit cbf996ca67
No known key found for this signature in database
2 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rules/S5344/java/how-to-fix-it/java-cryptography-extension.adoc
View File

@ -4,10 +4,9 @@
==== Noncompliant code example
The following code is vulnerable because it uses a legacy digest-based password
encoding that is not considered secure.
The derived key is vulnerable because the cost factor (rounds) is too low for the chosen algorithm.
[source,kotlin,diff-id=1,diff-type=noncompliant]
[source,java,diff-id=11,diff-type=noncompliant]
----
private SecretKey deriveKey(String password, byte[] salt) throws Exception {
PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt, 120000, 256); // Noncompliant
@ -18,7 +17,7 @@ private SecretKey deriveKey(String password, byte[] salt) throws Exception {
==== Compliant solution
[source,kotlin,diff-id=1,diff-type=compliant]
[source,javan,diff-id=11,diff-type=compliant]
----
private SecretKey deriveKey(String password, byte[] salt) throws Exception {
PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt, 210000, 256);

4
rules/S5344/java/how-to-fix-it/spring.adoc
View File

@ -7,7 +7,7 @@
The following code is vulnerable because it uses a legacy digest-based password
encoding that is not considered secure.
[source,java,diff-id=1,diff-type=noncompliant]
[source,java,diff-id=12,diff-type=noncompliant]
----
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth, DataSource dataSource) throws Exception {
@ -20,7 +20,7 @@ public void configureGlobal(AuthenticationManagerBuilder auth, DataSource dataSo
==== Compliant solution
[source,java,diff-id=1,diff-type=compliant]
[source,java,diff-id=12,diff-type=compliant]
----
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth, DataSource dataSource) throws Exception {