Java 编程语言中的口令屏蔽

　　尽管使用 Strings 收集和存储口令看起来似乎很合逻辑，它们并不适合存储诸如口令这样的敏感信息。这是因为 Strings 类型的对象是不可改变的——使用后不能重写或修改字符串的内容。应该使用一个 chars 数组作为代替。修订后的 PasswordField 如代码示例 5 所示，它是根据 Using Password-Based Encryption 改写而来。

　　代码示例 5：PasswordField.java

import java.io.*;
import java.util.*;

/**
* This class prompts the user for a password and attempts to mask input with "*"
*/

public class PasswordField {

  /**
   *@param input stream to be used (e.g. System.in)
   *@param prompt The prompt to display to the user.
   *@return The password as entered by the user.
   */

  public static final char[] getPassword(InputStream in, String prompt)
    throws IOException {

      MaskingThread maskingthread = new MaskingThread(prompt);
      Thread thread = new Thread(maskingthread);
      thread.start();

      char[] lineBuffer;
      char[] buf;
      int i;

      buf = lineBuffer = new char[128];

      int room = buf.length;
      int offset = 0;
      int c;

      loop:   while (true) {
         switch (c = in.read()) {
            case -1:
            case '':
               break loop;

            case '\r':
               int c2 = in.read();
               if ((c2 != '') && (c2 != -1)) {
                  if (!(in instanceof PushbackInputStream)) {
                     in = new PushbackInputStream(in);
                  }
                  ((PushbackInputStream)in).unread(c2);
                } else {
                  break loop;
                }

                default:
                   if (--room < 0) {
                      buf = new char[offset + 128];
                      room = buf.length - offset - 1;
                      System.arraycopy(lineBuffer, 0, buf, 0, offset);
                      Arrays.fill(lineBuffer, ' ');
                      lineBuffer = buf;
                   }
                   buf[offset++] = (char) c;
                   break;
         }
      }
      maskingthread.stopMasking();
      if (offset == 0) {
         return null;
      }
      char[] ret = new char[offset];
      System.arraycopy(buf, 0, ret, 0, offset);
      Arrays.fill(buf, ' ');
      return ret;
   }
}

　　最后，PasswordApp 类如代码示例 6 所示，它只是一个用于测试修订后代码的测试应用程序。

　　代码示例 6：PasswordApp.java

import java.io.*;

public class PasswordApp {
   public static void main(String argv[]) {
      char password[] = null;
      try {
         password = PasswordField.getPassword(System.in, "Enter your password: ");
      } catch(IOException ioe) {
         ioe.printStackTrace();
      }
      if(password == null ) {
         System.out.println("No password entered");
      } else {
         System.out.println("The password entered is: "+String.valueOf(password));
      }
   }
}