YYTVicky commented on pull request #327:
URL: https://github.com/apache/knox/pull/327#issuecomment-623485064
The parameter "tmp.getencoded()" used in SecretKeySpec should not be a
constant value, our tool suggest following new fix patch for
**SecretKey secret = new SecretKeySpec(tmp.getEncoded(), alg);**
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
keyGen.init(128);
SecretKey secretKey = keyGen.generateKey();
byte[] tmp= secretKey.getEncoded();
SecretKey secret = new SecretKeySpec(tmp, alg);
pls kindly take a look and hope to get feedback from you!
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
