🐛 (mirrors): Keep SecureRandom out of the native image heap
Changes
1 file changed, +4 -2
MODIFY
src/main/java/de/workaround/mirror/SecretCrypto.java
+4 -2
@@ -31,7 +31,9 @@
31
31
32
32
private static final int TAG_BITS = 128;
33
33
34
- private static final SecureRandom RANDOM = new SecureRandom();
34
+ // instance field, not static: a build-time-initialized static SecureRandom would land in the
35
+ // native image heap with a cached seed, which GraalVM rejects (and would be unsafe anyway)
36
+ private final SecureRandom random = new SecureRandom();
35
37
36
38
private final SecretKeySpec key;
37
39
@@ -65,7 +67,7 @@
65
67
try
66
68
{
67
69
byte[] iv = new byte[IV_BYTES];
68
- RANDOM.nextBytes(iv);
70
+ random.nextBytes(iv);
69
71
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
70
72
cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(TAG_BITS, iv));
71
73
byte[] ciphertext = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8));