Uploaded image for project: 'Qpid'
  1. Qpid
  2. QPID-8616

[Broker-J] Privacy Violation: Heap Inspection in ManagedUser

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Closed
    • Minor
    • Resolution: Implemented
    • qpid-java-broker-9.0.0
    • qpid-java-broker-9.1.0
    • Broker-J
    • None

    Description

      Sensitive data (such as passwords) stored in memory can be leaked if memory is not cleared after use. Often, Strings are used store sensitive data, however, since String objects are immutable, removing the value of a String from memory can only be done by the JVM garbage collector. The garbage collector is not required to run unless the JVM is low on memory, so there is no guarantee as to when garbage collection will take place. In the event of an application crash, a memory dump of the application might reveal sensitive data.

      Approach used in QPID-8583 should be applied to class ManagedUser.

      Attachments

        Activity

          People

            Unassigned Unassigned
            daniel.kirilyuk Daniil Kirilyuk
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: