CredentialsConfigurator, JmxModelImpl - use char[] for handling passwords - Fortify

Author: jisedlac

visualvm/jmx/src/org/graalvm/visualvm/jmx/impl/CredentialsConfigurator.java

@@ -74,8 +74,8 @@ public String getUsername() {
         return usernameField.getText().trim();
     }
 
-    public String getPassword() {
-        return new String(passwordField.getPassword());
+    public char[] getPassword() {
+        return passwordField.getPassword();
     }
 
     private CredentialsConfigurator() {
@@ -94,8 +94,8 @@ private void update() {
         SwingUtilities.invokeLater(new Runnable() {
             public void run() {
                 String username = getUsername();
-                String password = getPassword();
-                okButton.setEnabled(username.length() > 0 && password.length() > 0);
+                char[] password = getPassword();
+                okButton.setEnabled(username.length() > 0 && password.length > 0);
             }
         });
     }

visualvm/jmx/src/org/graalvm/visualvm/jmx/impl/JmxModelImpl.java

@@ -415,8 +415,8 @@ private static class ProxyClient implements NotificationListener {
 
         private ConnectionState connectionState = ConnectionState.DISCONNECTED;
         private volatile boolean isDead = true;
-        private String userName = null;
-        private String password = null;
+        private String user = null;
+        private char[] pword = null;
         private LocalVirtualMachine lvm;
         private JMXServiceURL jmxUrl = null;
         private Application app;
@@ -469,9 +469,9 @@ private ProxyClient(JmxModelImpl model, JMXServiceURL url, Application app,
             this.envProvider = envProvider;
         }
 
-        public void setCredentials(String userName, String password) {
-            this.userName = userName;
-            this.password = password;
+        public void setCredentials(String user, char[] pword) {
+            this.user = user;
+            this.pword = pword;
         }
 
         boolean hasSSLStubCheck() {
@@ -551,9 +551,8 @@ private void tryConnect() throws IOException {
                 Map<String, Object> env = new HashMap();
                 if (envProvider != null)
                     env.putAll(envProvider.getEnvironment(app, app.getStorage()));
-                if (userName != null || password != null)
-                    env.put(JMXConnector.CREDENTIALS,
-                            new String[] { userName, password });
+                if (user != null || pword != null)
+                    env.put(JMXConnector.CREDENTIALS, new String[] { user, new String(pword) });
 
                 if (!insecure && mode != MODE_LOCAL && env.get(JMXConnector.CREDENTIALS) != null) {
                     env.put("jmx.remote.x.check.stub", "true");     // NOI18N