Dump memory show user and password info

Question

I've been checking memory information dumping data hold in memory and I've seen a JSON structure of the request I use for login to the server.

For security reasons that information shouldn't be hold in memory so I've had to find out what is storing these data.

I tried to check OKHttp3 for avoiding caching any info but seems it could be GSON Converter.

this line https://github.com/square/retrofit/issues/2305 is from a guy complaining about Strings hold in memory.

I'd like to know if I could be right thinking about GSON as the problem and if there is any chance to let GSON know that I don't want to cache a concrete class.

Thanks

Answer 1

I think the problem is here :

There is two ways to add string in the string pool. first if you declare your string literal like below, the string will add to pool.

String test = "test"

second if you call intern method in string Object. like this.

String test = new String("test"); 
test.intern();

so if you declare you username and password like this :

String username = new String("YOUR_PASSWORD");

it will not add to pool unless you call intern method. so try the above way or use StringBuilder class. The garbage collection happens on your data.