Dev estimate: 1
Test estimate: 0.5
The following code exists in HmacSHA256Sign:
new String(Base64.encode(digest))
The input for the constructor is a byte array. This is unpredictable because if no encoding is specified, the constructor uses the platform's default charset. For example, if someone sets their platform's default charset to UTF-16, even ASCII characters will be un-parseable.
In the context of the code, it appears that the data should be interpreted using UTF-8. If that is the case, then, it should be made explicit.
Dev estimate: 1
Test estimate: 0.5
The following code exists in
HmacSHA256Sign:The input for the constructor is a byte array. This is unpredictable because if no encoding is specified, the constructor uses the platform's default charset. For example, if someone sets their platform's default charset to UTF-16, even ASCII characters will be un-parseable.
In the context of the code, it appears that the data should be interpreted using UTF-8. If that is the case, then, it should be made explicit.