search

palexdev / MaterialFX

A library of material components for JavaFX
GNU Lesser General Public License v3.0
1.2k stars 122 forks source link

MFXPasswordField extends regular TextField #187

Open M-K-Al opened 2 years ago

M-K-Al commented 2 years ago

MFXPasswordField returns passwords as Strings which is insecure. Please refer to this answer for more details.

Tech-Expert-Wizard commented 2 years ago

@M-K-Al So is the same for the JavaFX PasswordField. I'm going to see if I can submit a pull request for this. In the meantime, if you really need a secure option, then use Swing's JPasswordField. EDIT: It's actually really hard to make a secure PasswordField without making major rewrites of the JavaFX PasswordField. You could file a feature request to the JavaFX devs though. @palexdev I think this can be closed.

palexdev commented 2 years ago

@M-K-Al the JavaFX's PasswordField does the same. I don't think it's responsibility of the UI element but rather the user. Maybe you should convert the returned String to a char[]

Also note that even if JPasswordField offers a method to return the text as a char[] there still are methods that return String (even if deprecated they are there) Plus, the getPassword() which returns the char[] simply gets the text and converts it to char[] Security has little to do with UI

So, either I add a similar method but the implementation remains the same or I just ignore this. I'll have to think about this

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.