ObfuscatedString#toCharArray(): Unwarranted assumption that CharsetDecoder returns an array-based CharBuffer

[Dani-Hub]

The current implementation of ObfuscatedString#toCharArray() unconditionally returns from the obtained CharBuffer the result array by invoking its array() method. But there is no guarantee that CharsetDecoder.decode actually returns a result buffer that is backed by an array, though.

My recommendation would be to change the implementation so that it is guaranteed to work correctly regardless on assumptions about implementation details, something along the lines of the following:

final CharBuffer charBuffer = charset.newDecoder().decode(ByteBuffer.wrap(encoded, 0, length));
final char[] chars = new char[charBuffer.remaining()];
charBuffer.get(chars);
if (charBuffer.hasArray()) {
	Arrays.fill(charBuffer.array(), (char) 0);
}
return chars;

If agreement exists for this general idea, I would provide a corresponding pull request.