(tomcat) branch main updated: Work around null checks if passing null cert password

[remm]

This is an automated email from the ASF dual-hosted git repository.

remm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/main by this push:
     new 904701a434 Work around null checks if passing null cert password
904701a434 is described below

commit 904701a434325534b856b70f085dbe1dee05c43a
Author: remm <r...@apache.org>
AuthorDate: Mon Feb 3 16:02:51 2025 +0100

    Work around null checks if passing null cert password
    
    I doubt this will trigger security scanners this way.
    Based on PR815 submitted by Dmole.
---
 java/org/apache/tomcat/util/net/SSLUtilBase.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/org/apache/tomcat/util/net/SSLUtilBase.java 
b/java/org/apache/tomcat/util/net/SSLUtilBase.java
index 410a80c5d8..c2b98fd85d 100644
--- a/java/org/apache/tomcat/util/net/SSLUtilBase.java
+++ b/java/org/apache/tomcat/util/net/SSLUtilBase.java
@@ -318,7 +318,7 @@ public abstract class SSLUtilBase implements SSLUtil {
          * required key works around that.
          * Other keys stores (hardware, MS, etc.) will be used as is.
          */
-        char[] keyPassArray = null;
+        char[] keyPassArray = new char[0];
         String keyPassToUse = null;
         if (keyPassFile != null) {
             try (BufferedReader reader =


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org