Passwords should be wiped from memory partial implementation

CHANGELOG.md

@@ -2,13 +2,27 @@
 
 Trying to follow the suggestions at [Keep a Change Log](http://keepachangelog.com) and [Semantic Versioning](http://semver.org/spec/v2.0.0.html)
 
-##[2.2.2]
+## [2.2.3-SNAPSHOT]
+
+### Changed
+
+- Deprecated method Entry.getPassword(): This means that the method getPassword() in the Entry class has been marked as deprecated. Deprecated methods are no longer recommended for use and might be removed in future versions of the code.
+
+### Added
+
+- byte[] getPasswordAsBytes() to AbstractEntry class: This means that a new method getPasswordAsBytes() has been added to the AbstractEntry class. This method likely returns the password in the form of a byte array instead of a plain string.
+
+- byte[] getPropertyAsBytes(String name) to the Entry interface: This indicates that a new method getPropertyAsBytes(String name) has been added to the Entry interface. This method likely returns a specific property as a byte array.
+
+- Added test cases to ensure the byte password is used correctly: This means that new test cases have been added to the codebase to ensure that the handling of byte passwords is functioning correctly. These tests will help verify that the newly introduced methods are working as expected.
+
+## [2.2.2-SNAPSHOT]
 
 ### Added
 
 - implementation of database using Jackson
 
-##[2.2.1]
+## [2.2.1] 2023-08-21
 
 ### Added
 

all/pom.xml

@@ -19,7 +19,7 @@
     <parent>
         <artifactId>KeePassJava2-parent</artifactId>
         <groupId>org.linguafranca.pwdb</groupId>
-        <version>2.2.2-SNAPSHOT</version>
+        <version>2.2.3-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

all/src/main/java/org/linguafranca/pwdb/package-info.java

@@ -0,0 +1,9 @@
+/**
+ * This module provides a simple import of the database implementations of KeePass, "all" in the diagram below.
+ * <p>
+ *     <img src="https://github.com/jorabin/KeePassJava2/blob/master/ModuleStructure.svg">
+ * <p>
+ * @see <a href="https://github.com/jorabin/KeePassJava2/blob/master/readme.md#module-structure">Module Structure</a>
+ * in the readme at GitHub for a discussion of the project modules and links to JavaDocs.
+ */
+package org.linguafranca.pwdb;

database/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>KeePassJava2-parent</artifactId>
         <groupId>org.linguafranca.pwdb</groupId>
-        <version>2.2.2-SNAPSHOT</version>
+        <version>2.2.3-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

database/src/main/java/org/linguafranca/pwdb/Entry.java

@@ -118,6 +118,17 @@ interface Matcher {
      */
     void setProperty(String name, String value);
 
+     /**
+     * Gets the value of a property.
+     *
+     * <p>All implementations of Entry are required to support reading and writing of
+     * {@link #STANDARD_PROPERTY_NAMES}.
+     * @param name the name of the property to get
+     * @return a value or null if the property is not known, or if setting of arbitrary properties is not supported
+     * @see Database#supportsNonStandardPropertyNames()
+     */
+
+    byte[] getPropertyAsBytes(String name);
     /**
      * Removes this non-standard  property, if it exists.
      *
@@ -219,11 +230,23 @@ interface Matcher {
      * Gets the (unencrypted) password field for this entry.
      *
      * <p>Implementations should Touch LastAccessedTime when this method is called.
-     *
+     * 
+     * @deprecated because the string is immutable, and cannot be wiped from memory
+     * 
      * @return a password
      */
+    @Deprecated
     String getPassword();
 
+    /**
+     * Gets the (unencrypted) password field for this entry.
+     *
+     * <p>Implementations should Touch LastAccessedTime when this method is called.
+     *
+     * @return a password
+     */
+    public byte[] getPasswordAsBytes();
+
     /**
      * Sets the plaintext password for this Entry.
      *

database/src/main/java/org/linguafranca/pwdb/base/AbstractEntry.java

@@ -84,10 +84,16 @@ public void setUsername(String username) {
     }
 
     @Override
+    @Deprecated
     public String getPassword() {
         return getProperty(STANDARD_PROPERTY_NAME_PASSWORD);
     }
 
+    @Override
+    public byte[] getPasswordAsBytes() {
+        return getPropertyAsBytes(STANDARD_PROPERTY_NAME_PASSWORD);
+    }
+
     @Override
     public void setPassword(String pass) {
         setProperty(STANDARD_PROPERTY_NAME_PASSWORD, pass);

dom/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>KeePassJava2-parent</artifactId>
         <groupId>org.linguafranca.pwdb</groupId>
-        <version>2.2.2-SNAPSHOT</version>
+        <version>2.2.3-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

dom/src/main/java/org/linguafranca/pwdb/kdbx/dom/DomEntryWrapper.java

@@ -79,6 +79,11 @@ public void setProperty(String name, String value) {
         database.setDirty(true);
     }
 
+    @Override
+    public byte[] getPropertyAsBytes(String name) {
+       return getProperty(name).getBytes();
+    }
+
     @Override
     public boolean removeProperty(String name) throws IllegalArgumentException {
         if (STANDARD_PROPERTY_NAMES.contains(name)) throw new IllegalArgumentException("may not remove property: " + name);

example/pom.xml

@@ -19,7 +19,7 @@
     <parent>
         <artifactId>KeePassJava2-parent</artifactId>
         <groupId>org.linguafranca.pwdb</groupId>
-        <version>2.2.2-SNAPSHOT</version>
+        <version>2.2.3-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

example/src/test/java/org/linguafranca/pwdb/kdbx/validation/Issue33Test.java

@@ -10,6 +10,7 @@
 import org.linguafranca.pwdb.kdbx.KdbxCreds;
 import org.linguafranca.pwdb.kdbx.Util;
 import org.linguafranca.pwdb.kdbx.dom.DomDatabaseWrapper;
+import org.linguafranca.pwdb.kdbx.jackson.JacksonDatabase;
 import org.linguafranca.pwdb.kdbx.jaxb.JaxbDatabase;
 import org.linguafranca.pwdb.kdbx.simple.SimpleDatabase;
 
@@ -59,4 +60,10 @@ public void testSimpleDatabase() throws IOException {
         SimpleDatabase database = SimpleDatabase.load(CREDENTIALS, inputStream);
         database.save(new StreamFormat.None(), new Credentials.None(), Files.newOutputStream(Paths.get(TEST_OUTPUT_DIR, "Issue33Simple.xml")));
     }
+
+    @Test
+    public void testJacksonDatabase() throws IOException {
+        JacksonDatabase database = JacksonDatabase.load(CREDENTIALS, inputStream);
+        database.save(new StreamFormat.None(), new Credentials.None(), Files.newOutputStream(Paths.get(TEST_OUTPUT_DIR, "Issue33Jackson.xml")));
+    }
 }

jackson/pom.xml

@@ -18,7 +18,7 @@
   <parent>
     <artifactId>KeePassJava2-parent</artifactId>
     <groupId>org.linguafranca.pwdb</groupId>
-    <version>2.2.2-SNAPSHOT</version>
+    <version>2.2.3-SNAPSHOT</version>
     <relativePath>../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>
@@ -33,41 +33,21 @@
       <artifactId>KeePassJava2-kdbx</artifactId>
       <version>${project.version}</version>
     </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.dataformat</groupId>
+      <artifactId>jackson-dataformat-xml</artifactId>
+      <version>2.15.0</version>
+    </dependency>
+    <dependency>
+      <groupId>com.fasterxml.woodstox</groupId>
+      <artifactId>woodstox-core</artifactId>
+      <version>6.5.0</version>
+    </dependency>
     <dependency>
         <groupId>org.linguafranca.pwdb</groupId>
         <artifactId>test</artifactId>
         <version>${project.version}</version>
         <scope>test</scope>
       </dependency>
-      <dependency>
-        <groupId>com.fasterxml.jackson.dataformat</groupId>
-        <artifactId>jackson-dataformat-xml</artifactId>
-        <version>2.15.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.fasterxml.woodstox</groupId>
-        <artifactId>woodstox-core</artifactId>
-        <version>6.5.0</version>
-      </dependency>
-      <dependency>
-        <groupId>junit</groupId>
-        <artifactId>junit</artifactId>
-        <scope>test</scope>
-      </dependency>
     </dependencies>
-
-   <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <version>${maven-compiler-plugin.version}</version>
-                <configuration>
-                    <source>${java.version}</source>
-                    <target>${java.version}</target>
-                    <generatedSourcesDirectory>src/generated/java</generatedSourcesDirectory>
-                </configuration>
-            </plugin>
-        </plugins>
-    </build>
   </project>

jackson/src/main/java/org/linguafranca/pwdb/kdbx/jackson/JacksonEntry.java

@@ -94,18 +94,18 @@ public class JacksonEntry extends AbstractEntry<JacksonDatabase, JacksonGroup, J
     @JacksonXmlProperty(localName = "Times")
     protected Times times;
 
-    @JacksonXmlProperty(localName = "String") /** Workaround jackson **/
+    @JacksonXmlProperty(localName = "String") /* Workaround jackson */
     @JacksonXmlElementWrapper(useWrapping = false)
     protected List<StringProperty> string;
 
-    @JacksonXmlProperty(localName = "Binary") /** Workaround jackson **/
+    @JacksonXmlProperty(localName = "Binary") /* Workaround jackson */
     @JacksonXmlElementWrapper(useWrapping = false)
     protected List<BinaryProperty> binary;
 
     @JacksonXmlProperty(localName = "AutoType")
     protected AutoType autoType;
 
-    @JacksonXmlProperty(localName = "History") /** Workaround jackson **/
+    @JacksonXmlProperty(localName = "History") /* Workaround jackson */
     protected JacksonHistory history;
 
     @JsonIgnore
@@ -316,4 +316,9 @@ protected void touch() {
         this.times.setLastModificationTime(new Date());
         this.database.setDirty(true);
     }
+
+    @Override
+    public byte[] getPropertyAsBytes(String name) {
+        return getByteContent(getStringProperty(name, string));
+    }
 }

jackson/src/main/java/org/linguafranca/pwdb/kdbx/jackson/JacksonGroup.java

@@ -21,7 +21,9 @@
 import java.util.List;
 import java.util.UUID;
 
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
 import org.jetbrains.annotations.NotNull;
+import org.linguafranca.pwdb.base.AbstractGroup;
 import org.linguafranca.pwdb.kdbx.jackson.converter.StringToBooleanConverter;
 import org.linguafranca.pwdb.kdbx.jackson.converter.UUIDToBase64Converter;
 import org.linguafranca.pwdb.kdbx.jackson.converter.Base64ToUUIDConverter;
@@ -51,9 +53,8 @@
 "entry",
 "group",
 })
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class JacksonGroup
-        extends org.linguafranca.pwdb.base.AbstractGroup<JacksonDatabase, JacksonGroup, JacksonEntry, JacksonIcon> {
+@JsonIgnoreProperties(ignoreUnknown=true)
+public class JacksonGroup extends AbstractGroup<JacksonDatabase, JacksonGroup, JacksonEntry, JacksonIcon> {
 
     @JacksonXmlProperty(localName = "UUID")
     @JsonDeserialize(converter = Base64ToUUIDConverter.class)
@@ -100,12 +101,12 @@ public class JacksonGroup
     @JsonSerialize(converter = UUIDToBase64Converter.class)
     protected UUID lastTopVisibleEntry;
 
-    @JacksonXmlProperty(localName = "Entry") /** Workaround jackson **/
+    @JacksonXmlProperty(localName = "Entry") /* Workaround jackson */
     @JacksonXmlElementWrapper(useWrapping = false)
     protected List<JacksonEntry> entries;
 
 
-    @JacksonXmlProperty(localName = "Group") /** Workaround jackson **/
+    @JacksonXmlProperty(localName = "Group") /* Workaround jackson */
     @JacksonXmlElementWrapper(useWrapping = false)
     protected List<JacksonGroup> groups;
 

jackson/src/main/java/org/linguafranca/pwdb/kdbx/jackson/JacksonHistory.java

@@ -23,12 +23,12 @@
 
 public class JacksonHistory {
 
-    @JacksonXmlProperty(localName = "Entry") /** Workaround jackson **/
+    @JacksonXmlProperty(localName = "Entry") /* Workaround jackson */
     @JacksonXmlElementWrapper(useWrapping = false)
     private List<JacksonEntry> entry;
 
     public JacksonHistory() {
-        entry = new ArrayList<JacksonEntry>();
+        entry = new ArrayList<>();
     }
 
     /**