From 475744b515601f8621edfb02f99e6e46d70a4a39 Mon Sep 17 00:00:00 2001
From: Sergey Gorbaty <sgorbaty@apple.com>
Date: Tue, 17 Apr 2018 15:32:33 -0700
Subject: [PATCH] Code example

---
 .../src/main/resources/category/java/security.xml   | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pmd-java/src/main/resources/category/java/security.xml b/pmd-java/src/main/resources/category/java/security.xml
index 15eed88266..67b89c28e5 100644
--- a/pmd-java/src/main/resources/category/java/security.xml
+++ b/pmd-java/src/main/resources/category/java/security.xml
@@ -10,22 +10,31 @@ Rules that flag potential security flaws.
     </description>
     
         <rule name="InsecureCryptoIv"
-          since="6.1"
+          since="6.3"
           message="Do not use hard coded initialization vector in crypto operations"
           class="net.sourceforge.pmd.lang.java.rule.security.InsecureCryptoIvRule"
           externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_security.html#insecurecryptoiv">
         <description>
-Do not use hard coded initialization vector in cryptographic operations. Please use randomly generated IV.
+Do not use hard coded initialization vector in cryptographic operations. Please use a randomly generated IV.
         </description>
         <priority>3</priority>
         <example>
 <![CDATA[
 public class Foo {
     void good() {
+        SecureRandom random = new SecureRandom();
+        byte iv[] = new byte[16];
+        random.nextBytes(bytes);
     }
 
     void bad() {
+        byte[] iv = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, };
     }
+    
+    void alsoBad() {
+        byte[] iv = "secret iv in here".getBytes();
+    }
+    
 }
 ]]>
         </example>