]
Ilia Vassilev updated ELY-1552:
-------------------------------
Component/s: Authentication Mechanisms
Coverity, Reliance on default encoding in
DigestAuthenticationMechanism.
------------------------------------------------------------------------
Key: ELY-1552
URL:
https://issues.jboss.org/browse/ELY-1552
Project: WildFly Elytron
Issue Type: Bug
Components: Authentication Mechanisms
Affects Versions: 1.2.4.Final
Reporter: Ilia Vassilev
Assignee: Ilia Vassilev
Priority: Minor
In
org.wildfly.security.http.impl.DigestAuthenticationMechanism.digestUriMatchesRequestUri(org.wildfly.security.http.HttpServerRequest,
byte[]): Found a call to a method which will perform a byte to String (or String to byte)
conversion, and will assume that the default platform encoding is suitable.
{code}
private boolean digestUriMatchesRequestUri(HttpServerRequest request, byte[] digestUri)
{
if (!validateUri) {
return true;
}
java.net.URI requestURI = request.getRequestURI();
String digestUriStr = new String(digestUri);
{code}
https://scan7.coverity.com/reports.htm#v20225/p11778/fileInstanceId=49333...