[
https://issues.apache.org/jira/browse/LOG4J2-1896?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15999955#comment-15999955
]
Gary Gregory commented on LOG4J2-1896:
--------------------------------------
Up to you. I was going to leave it as is and follow up with another ticket. I
wanted to make it clear what happened technically even if the overall store is
not complete. If you want to do it differently, please do go ahead ;-) This
way, if a release occurs and the story is not done, we can see which steps have
been done.
> Update org.apache.logging.log4j.core.net.ssl.StoreConfiguration from a String
> to char[] to represent its password
> -----------------------------------------------------------------------------------------------------------------
>
> Key: LOG4J2-1896
> URL: https://issues.apache.org/jira/browse/LOG4J2-1896
> Project: Log4j 2
> Issue Type: Improvement
> Components: Configurators
> Reporter: Gary Gregory
> Assignee: Gary Gregory
> Fix For: 2.9
>
>
> Update {{org.apache.logging.log4j.core.net.ssl.StoreConfiguration}} from a
> {{String}} to {{char[]}} to represent its password.
> The goal is to reduce the security risk of using a String for a password. See
> https://stackoverflow.com/questions/8881291/why-is-char-preferred-over-string-for-passwords
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
