Enterprise Library Test Guide - Willy .Net

248
Enterprise Library Test Guide
the connection string without including sensitive information such as the password.
The following is the modified code.
protected internal string ConnectionString
{
get
{
return this.connectionString.ToString();
}
}
public string ConnectionStringWithoutCredentials
{
get
{
return ConnectionStringNoCredentials;
}
}
Verification
Running the test case again after modifying the code verified that the Connection-
StringWithoutCredentials property did not return the password.
Testing the Cryptography Application Block
This test case determined whether the Cryptography Application Block cleared a
decrypted key from memory after using it to encrypt and decrypt data.
Test Case
During a code review, the SymmetricCryptographer and HashCryptographer classes
were examined to see if they cleared decrypted keys from memory after using them.
Problem
The code review revealed that the SymmeticCryptographer and HashCryptographer
classes did not clear decrypted keys from memory before returning the data. The following
code shows the SymmetricCryptographer code. The code for the HashCryptographer
class was similar.
public byte[] Decrypt(byte[] encryptedText)
{
byte[] output = null;
byte[] data = ExtractIV(encryptedText);
this.algorithm.Key = Key;
using (ICryptoTransform transform = this.algorithm.CreateDecryptor())
{
output = Transform(transform, data);
}
return output;
}