[
https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12569000#action_12569000
]
Daniel John Debrunner commented on DERBY-3014:
----------------------------------------------
In the patch this code:
key.substring(0,11).equals("derby.user.")
is really does the key start with "derby.user." Java's String class already has
a method that implements this, 'startsWith'
thus the code can be simplified to
key.startsWith("derby.user.")
With Java it's good to read the javadoc of any classes you are using, typically
any functionality you need already exists.
Then software projects usually have defined constants for any literals they
need (e.g. Strings and ints). This has several benefits, changing the value of
the constant requires change in one place, a defined constant provides more
information that just the literal (e..g READ_COMMITTED instead of 2) when used,
finding out which code depends on the constant can be a search on the defined
constant instead of the value. Imagine trying to find all code that depended
on the literal 2 when 2 might represent different concepts in different
contexts, searching for READ_COMMITTED is much easier.
So in the class org.apache.derby.iapi.reference.Property a defined constant
already exist: USER_PROPERTY_PREFIX which then changes the code to:
key.startsWith(Property.USER_PROPERTY_PREFIX )
There are a couple of ways to find such constants:
- search through the code and thus gain some more understanding of the code
- ask a question on derby-dev, folks will be happy to point others in the
right direction
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return
> NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current
> returned hash value could be used in an off-line dictionary based attack to
> find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
