Question

我有一个在SecureString字段内部存储密码的类。据我所知，这可以保护这个字段不被写入日志，转储等。因为有时（...总是）我使用这个类与静态凭证我想创建额外的构造函数采取字符串而不是SecureString并生成密码值在构造函数中。

public class Test1Controller implements Initializable {
    @FXML private TableView<TransitionRow> outputTable;
    @FXML private TableColumn<TransitionRow, Double> col1;
    @FXML private TableColumn<TransitionRow, Double> col2;
    @FXML private TableColumn<TransitionRow, String> col3;

    private ObservableList<TransitionRow> data;

    @Override
    public void initialize(URL url, ResourceBundle rb) {
        outputTable = new TableView<TransitionRow>();

        col1 = new TableColumn<TransitionRow,Double>("Harland");
        col1.setCellValueFactory(new PropertyValueFactory<TransitionRow, Double>("scaleY"));

        col2 = new TableColumn<TransitionRow,Double>("Gradstein");
        col2.setCellValueFactory(new PropertyValueFactory<TransitionRow, Double>("gradsteinAge"));

        col3 = new TableColumn<TransitionRow,String>("Label");
        col3.setCellValueFactory(new PropertyValueFactory<TransitionRow, String>("oldName"));

        // This line should cause the column names on the GUI to change. They don't.
        outputTable.getColumns().addAll(col1, col2, col3);

        data = getInitialTableData();

        // This line should cause rows of data to appear on the TableView. It doesn't.
        outputTable.setItems(data);

    }    

    private ObservableList<TransitionRow> getInitialTableData() {
        List<TransitionRow> list = new ArrayList<>();

        TransitionRow tr1 = new TransitionRow();
        tr1.setScaleY((Double) 124.567d);
        tr1.setGradsteinAge((Double) 130.001d);
        tr1.setOldName("Stuff");

        TransitionRow tr2 = new TransitionRow();
        tr2.setScaleY((Double) 456.546d);
        tr2.setGradsteinAge((Double) 123.768d);
        tr2.setOldName("Other stuff");

        list.add(tr1);
        list.add(tr2);

        ObservableList<TransitionRow> results = FXCollections.observableList(list);
        return results;
    }
}

所以我的问题是：鉴于密码已经作为字符串在某处可用，是否正在创建此构造函数并传递字符串变量以创建任何其他安全风险？

在构造函数中使用字符串而不是SecureString

0 个答案: