Details about the known misuse from the MUBench dataset.
Description:
The key used is defined statically in the code.
Fix Description:
Generate a non-predictable key.
Violation Types:
missing/condition/value_or_state
In File:
mubench/examples/jca/Encrypting.java
In Method:
encryptWithKey(byte[])
Code with Misuse:
class Encrypting {
public static byte[] encryptWithKey(byte[] content) throws Exception {
// using a constant key is unsafe
SecretKeySpec keySpec = new SecretKeySpec("RAS".getBytes("UTF-8"), "AES/CBC/PKCS5Padding");
Cipher c = Cipher.getInstance("AES");
c.init(Cipher.ENCRYPT_MODE, keySpec);
return c.doFinal(content);
}
}
