SV.STRBUF.CLEAN

SV.STRBUF.CLEAN occurs when potentially secure data is not cleared from a StringBuffer.

Vulnerability and risk

Relying on the garbage collector to clear data is not safe. An attacker can access data that has not been released.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Do not use mutable objects to store sensitive data. If you must use mutable objects for sensitive data, NULL the object immediately after use.

Example 1

16     private void processingData(String user) throws SQLException {
17         String credential = getCredential(user);
18         // ...
19     }
20 
21     private String getCredential(String user) throws SQLException {
22         Statement statement = con.createStatement();
23         try {
24             StringBuffer buffer = new StringBuffer();
25             ResultSet resultSet = statement.executeQuery("SELECT * FROM credentials WHERE name='" + user + '\'');
26             while (resultSet.next()) {
27                 String key = resultSet.getString("key");
28                 buffer.append(key);
29             }
30 
31             final String result = buffer.toString();
32             return result;
33         } finally {
34             statement.close();
35         }
36     }

SV.STRBUF.CLEAN is reported for line 24: String buffer 'buffer' not cleaned before garbage collection.

Example 2

16     private void processingData(String user) throws SQLException {
17         String credential = getCredential(user);
18         // ...
19 
20     }
21 
22     private String getCredential(String user) throws SQLException {
23         Statement statement = con.createStatement();
24         StringBuffer buffer = new StringBuffer();
25         try {
26             ResultSet resultSet = statement.executeQuery("SELECT * FROM credentials WHERE name='" + user + '\'');
27             while (resultSet.next()) {
28                 String key = resultSet.getString("key");
29                 buffer.append(key);
30             }
31 
32             final String result = buffer.toString();
33             return result;
34         } finally {
35             buffer.delete(0, buffer.length());
36             statement.close();
37         }
38     }                                

The snippet from the previous section is fixed; SV.STRBUF.CLEAN is not reported here.

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.