Gregor Scholtysik created NET-746:
-------------------------------------
Summary: FTP: Use char[] instead of String for sensitive data /
login
Key: NET-746
URL: https://issues.apache.org/jira/browse/NET-746
Project: Commons Net
Issue Type: Improvement
Components: FTP
Affects Versions: 3.13.0
Reporter: Gregor Scholtysik
{{FTPClient#login}} uses {{String}} for password information. Instead, a
{{char[]}} array should be provided and zeroed after transmitting the command
to the buffer, e.g. using {{Arrays.fill(password, '\0')}}.
{{FTP#sendCommand}} and {{FTP#buildMessage}} should also have overloads for
{{char[]}} messages (for callers like {{FTPClient#login}}) or operate on char
arrays directly.
In {{FTP#send}}, {{java.io.BufferedWriter#write}} also accepts a {{char[]}}
parameter, so there shouldn't be any compatibility issues here.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
