This discussion is archived
1 2 Previous Next 17 Replies Latest reply: Oct 3, 2005 7:03 AM by 807587 Go to original post RSS
  • 15. Re: String Constant Pool...
    800387 Newbie
    Currently Being Moderated
    Bumped from a while ago.

    I had an additional question: where is the string pool? Perm? Tenured? Survivor Spaces? Eden? Or is it in a completely separate area of memory not eligible for garbage collection?

    Just curious.

    - Saish
  • 16. Re: String Constant Pool...
    807592 Newbie
    Currently Being Moderated
    Great line of questioning, Cedric.

    My question is, if I have a String that I create in a local function where a user provides me his password, will that password become cached in the String Pool? Will this be in plain text for someone with a "ram inspector" to easily see?

    RandPass gen = new RandPass();
    String newPass = gen.getPass();

    Thank you kindly in advance for anyone who is wise enough to know the answer.

    - Jim
  • 17. Re: String Constant Pool...
    796440 Guru
    Currently Being Moderated
    Jim_Manico wrote:
    Great line of questioning, Cedric.

    My question is, if I have a String that I create in a local function where a user provides me his password, will that password become cached in the String Pool?
    No. Only String literals and those Strings on which you call intern() end up in the constant pool. However...
    Will this be in plain text for someone with a "ram inspector" to easily see?
    ...Yes, it will. Regardless of whether it's cached, Strings are immutable, so you have no way* to clear out that String object's characters. Once it's GCed, the memory may be re-used, but you have no idea when that will be, if ever.

    For GUIs, there's a PasswordDialog or somesuch class that use char arrays rather than strings, so you can clear it out immediately after using it. If you're not doing this in a GUI, you can still achieve the same effect by using char[] rather than String.

    *Short of an ugly reflection hack that won't necessarily always work anyway.

    Edited by: jverd on Oct 30, 2007 11:57 PM
1 2 Previous Next