Class SecureString
- java.lang.Object
-
- org.elasticsearch.common.settings.SecureString
-
- All Implemented Interfaces:
java.io.Closeable
,java.lang.AutoCloseable
,java.lang.CharSequence
public final class SecureString extends java.lang.Object implements java.lang.CharSequence, java.io.Closeable
A String implementations which allows clearing the underlying char array.
-
-
Constructor Summary
Constructors Constructor Description SecureString(char[] chars)
Constructs a new SecureString which controls the passed in char array.SecureString(java.lang.String s)
Deprecated.Only use for compatibility between deprecated string settings and new secure strings
-
Method Summary
Modifier and Type Method Description char
charAt(int index)
SecureString
clone()
Returns a new copy of this object that is backed by its own char array.void
close()
Closes the string by clearing the underlying char array.boolean
equals(java.lang.Object o)
Constant time equality to avoid potential timing attacks.char[]
getChars()
Returns the underlying char[].int
hashCode()
int
length()
SecureString
subSequence(int start, int end)
java.lang.String
toString()
Convert to aString
.
-
-
-
Constructor Detail
-
SecureString
public SecureString(char[] chars)
Constructs a new SecureString which controls the passed in char array. Note: When this instance is closed, the array will be zeroed out.
-
SecureString
@Deprecated public SecureString(java.lang.String s)
Deprecated.Only use for compatibility between deprecated string settings and new secure stringsConstructs a new SecureString from an existing String. NOTE: This is not actually secure, since the provided String cannot be deallocated, but this constructor allows for easy compatibility between new and old apis.
-
-
Method Detail
-
equals
public boolean equals(java.lang.Object o)
Constant time equality to avoid potential timing attacks.- Overrides:
equals
in classjava.lang.Object
-
hashCode
public int hashCode()
- Overrides:
hashCode
in classjava.lang.Object
-
length
public int length()
- Specified by:
length
in interfacejava.lang.CharSequence
-
charAt
public char charAt(int index)
- Specified by:
charAt
in interfacejava.lang.CharSequence
-
subSequence
public SecureString subSequence(int start, int end)
- Specified by:
subSequence
in interfacejava.lang.CharSequence
-
toString
public java.lang.String toString()
Convert to aString
. This should only be used with APIs that do not takeCharSequence
.- Specified by:
toString
in interfacejava.lang.CharSequence
- Overrides:
toString
in classjava.lang.Object
-
close
public void close()
Closes the string by clearing the underlying char array.- Specified by:
close
in interfacejava.lang.AutoCloseable
- Specified by:
close
in interfacejava.io.Closeable
-
clone
public SecureString clone()
Returns a new copy of this object that is backed by its own char array. Closing the new instance has no effect on the instance it was created from. This is useful for APIs which accept a char array and you want to be safe about the API potentially modifying the char array. For example:try (SecureString copy = secureString.clone()) { // pass thee char[] to a external API PasswordAuthentication auth = new PasswordAuthentication(username, copy.getChars()); ... }
- Overrides:
clone
in classjava.lang.Object
-
getChars
public char[] getChars()
Returns the underlying char[]. This is a dangerous operation as the array may be modified while it is being used by other threads or a consumer may modify the values in the array. For safety, it is preferable to useclone()
and pass its chars to the consumer when the chars are needed multiple times.
-
-