Bad hexadecimal concatenation

Docs > Code Analysis > Static Analysis Rules > Bad hexadecimal concatenation

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: java-security/bad-hexa-concatenation

Language: Java

Severity: Warning

Category: Security

CWE: 704

Description

Using Integer.toHexString() may trim leading zeroes and other missing information. This mistake weakens the hash value computed since it introduces more collisions. For example, the hash values “0x0123” and “0x1203” would both output as “123” for the above function.

Non-Compliant Code Examples

class NotCompliant {
    public void myMethod() {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] resultBytes = md.digest(password.getBytes("UTF-8"));

        StringBuilder stringBuilder = new StringBuilder();
        for(byte b :resultBytes) {
            stringBuilder.append(Integer.toHexString( b & 0xFF ));
        }

        return stringBuilder.toString();
    }
}

Compliant Code Examples

class NotCompliant {
    public void myMethod() {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] resultBytes = md.digest(password.getBytes("UTF-8"));

        StringBuilder stringBuilder = new StringBuilder();
        for(byte b :resultBytes) {
            stringBuilder.append( String.format( "%02X", b ) );
        }

        return stringBuilder.toString();
    }
}