Posts

Showing posts with the label Code Conversions

Use Braces Even For Single Line Statement

Image
On Feb. 21, 2014, Apple released security update for iOS that affected SSL/TLS connections. The impact is described as "An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS." And the CVSS v2 Base Score is 6.8(AV:N/AC:M/Au:N/C:P/I:P/A:P). What's the problem with it? Here is the Apple code : static OSStatus SSLVerifySignedServerKeyExchange(SSLContext *ctx, bool isRsa, SSLBuffer signedParams, uint8_t *signature, UInt16 signatureLen) { ... if ((err = ReadyHash(&SSLHashSHA1, &hashCtx)) != 0) goto fail; if ((err = SSLHashSHA1.update(&hashCtx, &clientRandom)) != 0) goto fail; if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0) goto fail; if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0) goto fail; goto fail; if ((err = SSLHashSHA1.final(&hashCtx, &has...
Read more

A Simple Shell Script to Check the Trap of Case-Insensitive String

In the post of " The Trap of Case-Insensitive String ", it is talked about the locale sensitive of String.toUpperCase() or String.toLowerCase(). I wrote a very simple KSH script to check the potential problems in Java source code. The script may be useful to facilitate the checking of the trap. #!/bin/ksh set -A KEYWORDS KEYWORDS[0]="toLowerCase\(\)|toUpperCase\(\)" typeset -i keywords_number=1 # KEYWORDS[0]="toLowerCase\(\).hashCode\(\)" # KEYWORDS[1]="toUpperCase\(\).hashCode\(\)" # KEYWORDS[2]="toLowerCase\(\).equals\(" # KEYWORDS[3]="toUpperCase\(\).equals\(" # typeset -i keywords_number=4 EXCLUDE_LINES="\/\/| \* " # inaccurate filter typeset -i keywords_i=0 while [ ${keywords_i} -lt ${keywords_number} ]; do echo echo Running "Checking operatoin ${KEYWORDS[${keywords_i}]} ..." find ./ -name "*.java" |xargs egrep "${KEYWORDS[${keywords_i}]}" \ |egrep -v ...
Read more

The Trap of Case-Insensitive String

Let's start from an example. What's the expect result of the following simple code? // Example One String lower = "Simple Smiles!"; String upper = "SIMPLE SMILES!"; int lowerHashCode = lower.toUpperCase().hashCode(); int upperHashCode = upper.toUpperCase().hashCode(); boolean isEqual = (lowerHashCode == upperHashCode); System.out.println("The hash codes of the two case-insensitive " + "strings are the same: " + isEqual); What's the value of "isEqual" variable, "true" or "false"? If you try to compiler and run the above code, I believe, 99.9999 times out of 100, the value of "isEqual" is "true". What's the chance for the remaining 0.0001? OK, let's run one more example. Copy/past the following code, and run it. // Example Two // // To illustrate the unexpected behaviors of case-insensitive strings // import java.util.Locale; public cl...
Read more