fix: CWE-256 in src/main/java/org/cysecurity/cspf/jvl/controller/Register.java - #46

Automated code fix — CWE-256

File: src/main/java/org/cysecurity/cspf/jvl/controller/Register.java
Severity: high
Lane: code-fix
Skill used: default-secure-coding

Assessment

• Exploitability: Any attacker who registers via the public endpoint has their password stored in cleartext, and any DB compromise or SQLi (also present here) exposes all credentials.
• Confidence: 0.95

Rationale

The finding flags cleartext storage of passwords (CWE-256): the raw password request parameter was inserted directly into the users table. I added a minimal hashPassword helper that derives a salted, iterated SHA-256 hash using java.security classes already available in the JRE (no new dependencies), producing a self-describing iterations$salt$hash string. The INSERT now stores hashedPass instead of the cleartext pass. On hash algorithm failure the request fails closed by redirecting to Register.jsp. All other logic, signatures, and the surrounding (separate) SQL-injection concern are left unchanged, keeping the patch narrowly scoped to the reported CWE-256 issue.

Validation

• Patched file parses and the scanner that raised this finding no longer flags it.

Opened by the vulnerability management platform after human approval.