字符串不变性与nodejs / expressjs中的请求参数有关

Question

I am working on a project where an issue has been raised from my security team about the sensitive information that we captured in string and about the presence of that information in memory heap.

As per the best practices I found over the internet is clearing out all your variables to null to wipe out the original value from memory. But Strings are immutable and they will be there in memory even if we set variables to null. so the value of string will always be there.

Image demo for string memory allocation

So I think this value stays in memory till the next GC cycle.setting null will not wiped out this immediatly.

A suggestion came to me is, not using string for such tasks. They suggest me to use buffers in nodejs.

Now I have some assumptions and some questions where I need advice.

1. We can get request body from body-parser module in form of buffers. But in that case I am not sure how to use that information if I want to insert records in DB etc.

 app.use(bodyParser.json({ verify: function(req, res, buf, encoding) { req.rawBody = buf; console.log("rawBody", req.rawBody); // print buffer info console.log("rawBody in json", JSON.parse(req.rawBody.toString())); // print json format of request body } })); 

2. If I create Buffer from a request.body.key and pass it to some function and use buffer's tostring() method to use it and then I zero out the buffer to remove the original value then does this toString() method create a memory space for text value and does not go away when I clear the buffer?

 callSomeSecurityFun (Buffer.from(request.body.password)); function callSomeSecurityFun (passwordBuf) { var encryptedPassword = someencryptionLib.encryptPass (passwordBuf.toString(),'<some key>', '<some algo>'); passwordBuf.fil (0);// clearing the buffer. return encryptedPassword; } 

3. How nodejs memory allocation for all the request.body parameters works? Is every value inside body object which is string is immutable? and always there in memory? If yes what if somebody dumped the heap and have access to all the sensitive information? Or I am completely wrong about it?

Thoughts/Suggestion?

sgoyal

Answer 1

But Strings are immutable and they will be there in memory even if we set variables to null. so the value of string will always be there.

Like any other value, the string will be there until the garbage collector will be activated. Setting the variable to null causes the value to become garbage (ie nothing points to it), so it will be cleaned from the heap eventually.