The current implementation of ObfuscatedString#toCharArray() unconditionally returns from the obtained CharBuffer the result array by invoking its array() method. But there is no guarantee that CharsetDecoder.decode actually returns a result buffer that is backed by an array, though.
My recommendation would be to change the implementation so that it is guaranteed to work correctly regardless on assumptions about implementation details, something along the lines of the following:
final CharBuffer charBuffer = charset.newDecoder().decode(ByteBuffer.wrap(encoded, 0, length));
final char[] chars = new char[charBuffer.remaining()];
charBuffer.get(chars);
if (charBuffer.hasArray()) {
Arrays.fill(charBuffer.array(), (char) 0);
}
return chars;
If agreement exists for this general idea, I would provide a corresponding pull request.
The current implementation of
ObfuscatedString#toCharArray()unconditionally returns from the obtainedCharBufferthe result array by invoking itsarray()method. But there is no guarantee thatCharsetDecoder.decodeactually returns a result buffer that is backed by an array, though.My recommendation would be to change the implementation so that it is guaranteed to work correctly regardless on assumptions about implementation details, something along the lines of the following:
If agreement exists for this general idea, I would provide a corresponding pull request.