search

securesauce / precli

Precaution CLI - command line static application security testing tool
https://precli.readthedocs.io/
Other
13 stars 3 forks source link

Don't break code with suggested fix #425

Closed ericwb closed 4 months ago

ericwb commented 4 months ago

The weak random Java rule currently suggests a fix that tells the user to use the constructor insteead of getInstance method. As a result, the NoSuchAlgorithmException doesn't get thrown. So the fix would create code that no longer compiles.

This change now swaps the weak random algorithm with a strong one that is known to exists for all platforms.