Our license is just letters and numbers. Even if it is not its MD5 will
have only numbers and letters. I think we are on the safe side here.


On Tue, May 20, 2014 at 9:47 PM, Jaromir Hamala <notifications@github.com>wrote:

> In hazelcast/src/main/java/com/hazelcast/util/VersionCheck.java:
>
> >          }
> > +
> > +        String urlStr = "http://www.hazelcast.com/version.jsp?version=" + version
> > +                + "&m=" + hazelcastNode.getLocalMember().getUuid()
> > +                + "&e=" + isEnterprise
> > +                + "&l=" + hazelcastNode.getConfig().getLicenseKey()
>
> My comment was not related to a security, but rather to URL encoding. If
> the licenseKey contained ampersand or other special characters than it
> would messed up the URL query parameters.
>
> MD5 is safe from this perspective, but I don't think VersionCheck should
> rely on a particular format of a license key (unless there is a test)
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/hazelcast/hazelcast/pull/2458/files#r12861090>
> .
>