Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Increasingly, programmers view strings as a portable means of storing and communicating arbitrary data, such as numeric values.   For example, a real-world system stored stores the binary values of encrypted passwords as strings in a database.   Non-character Noncharacter data may not be representable as a string, because not all bit patterns represent valid characters in most character sets. Consequently, programmers must not convert noncharacter data to a string. 

...

This noncompliant code example attempts to convert a BigInteger value to a String and then restore it back againto a BigInteger value. The toByteArray() method used returns a byte array containing the two's-complement representation of this BigInteger. The byte array is in big-endian byte - order: the most significant byte is in the zeroth element.   The program uses the String(byte[] bytes) constructor to create the string from the byte array.   The behavior of this constructor when the given bytes are not valid in the default character set is unspecified, which is likely to be the case.   Specifying the character set as a string also has unspecified behavior, although the Java API [API 2014] document claims that the String(byte[], Charset)  method always replaces malformed-input and unmappable-character sequences with this character set's default replacement string.   In any case, converting the String back to a BigInteger is unlikely to reproduce the original value. 

...

Compliant Solution (Base64)

While Although Java does not provide a character set that guarantees lossless encoding of byte data, there are many other solutions exist for safely converting an arbitrary byte array into a string and back. Java 8 introduced the java.util.Base64 class, which provides encoders and decoders for the Base64 encoding scheme. This compliant solution uses Base64 to safely convert a number to a string and back without corrupting the data.:

Code Block
bgColor#ccccff
languagejava
BigInteger x = new BigInteger("530500452766");
byte[] byteArray = x.toByteArray();
String s = Base64.getEncoder().encodeToString(byteArray);
byteArray = Base64.getDecoder().decode(s);
x = new BigInteger(byteArray);

...

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

STR03-J

lowLow

unlikelyUnlikely

mediumMedium

P2

L3

Related Guidelines

MITRE CWE

CWE-838. , Inappropriate Encoding for Output Context

...