4 ms·
BTW, this code would have trouble sending messages between locales. I had a quick look at the encryption code, and found this: public static String sign(Pr
by bazzargh 13y ago
BTW, this code would have trouble sending messages between locales. I had a quick look at the encryption code, and found this:
public static String sign(PrivateKey privateKey,
String data, String derivedPassword) {
return sign(privateKey, data.getBytes(), derivedPassword.getBytes());
}
... which of course uses the current platform's character set, not a consistent one across platforms. Definitely not what you want in this kind of application (unless Android is UTF-8 in all countries? I don't code for it). That was in this class:
https://github.com/surespot/android/blob/master/src/com/twofours/surespot/encryption/EncryptionController.java https://github.com/surespot/android/blob/master/src/com/twof...
...but someone making a mistake with getBytes() usually does it everywhere.
- bazzargh 13y agoJust thinking about that - this class of error gets reported by Findbugs and other static analysis tools. So, this bug indicates that there aren't tools like that in the build - for a security app, where correctness should be top priority, that's surprising.
- bazzargh 13y agoSo I raised an issue with Surespot, and it is indeed the case that Android uses UTF-8 everywhere by default, independent of locale (much more sensible than Sun's Java!). The code is correct. Nothing to see here, move along.