Java中的owasp敏感数据预防

Question

owasp sensitive data prevention in java

In my code I wrote following line and got A6-Sensitive Data Exposure- Heap Inspection

private String password;

How should I change this code for owasp sensitive data prevention in java?

Answer 1

Still not clear which tool gave you this warning at this line (it is unlikely that it was the dependency check). I can only guess the tool wants passwords to be stored in a char[] rather than a String .

The reasoning is that you can overwrite the password with blanks if it is no longer needed and therefore minimise the chance that it shows up in heap dumps.