Why you should upgrade SQLCipher to latest (3.0.2) version

If you're using SQLCipher (for Android) version <= 3.0.1, then your application may potentially leak sensitive data into the log system. That's because in case of error in its underlying native library, the (SQLCipher) Android wrapper library was printing the original query values into the log system.
This issue was fixed on February 1st, 2014 and integrated in version 3.0.2.

I'm including here a short demo that demonstrates the problem.

I've created a new basic project using Android Studio. Then downloaded SQLCipher for Android version 2.2.1, unzipped and added all the content to the project. This is the structure:

MyApplication class holds SQLCipher initialization. Nothing interesting here.


On database creation, I'm creating a single table called users with id, name and email columns. The most important thing here is the unique constraint that I'm setting for name and email columns.


For UI, I added a button that once clicked, opens a database and inserts a record with hardcoded values. Intentionally. On first click, the record will be added successfully. But on second click it is going to fail (because of unique constraint).



To this point everything works as expected, but you might be surprised with what was written to the log system:

03-22 19:25:56.615 11427-11427/info.osom.sqlciphertest E/Database? Error inserting email=my@email.com name=Alex
net.sqlcipher.database.SQLiteConstraintException: error code 19: columns name, email are not unique
at net.sqlcipher.database.SQLiteStatement.native_execute(Native Method)
at net.sqlcipher.database.SQLiteStatement.execute(SQLiteStatement.java:58)
at net.sqlcipher.database.SQLiteDatabase.insertWithOnConflict(SQLiteDatabase.java:1657)
at net.sqlcipher.database.SQLiteDatabase.insert(SQLiteDatabase.java:1517)
at info.osom.sqlciphertest.MainActivity$PlaceholderFragment$1.onClick(MainActivity.java:78)
at android.view.View.performClick(View.java:4202)
at android.view.View$PerformClick.run(View.java:17340)
at android.os.Handler.handleCallback(Handler.java:725)
at android.os.Handler.dispatchMessage(Handler.java:92)
at android.os.Looper.loop(Looper.java:137)
at android.app.ActivityThread.main(ActivityThread.java:5039)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:511)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:793)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:560)
at dalvik.system.NativeStart.main(Native Method)

Once you upgrade, this insert constraint exception will be redacted:

03-29 17:30:08.558  20832-20832/info.osom.sqlciphertest E/Database? Error inserting redacted values  into users
    net.sqlcipher.database.SQLiteConstraintException: error code 19: columns name, email are not unique
            at net.sqlcipher.database.SQLiteStatement.native_execute(Native Method)
            at net.sqlcipher.database.SQLiteStatement.execute(SQLiteStatement.java:58)
            at net.sqlcipher.database.SQLiteDatabase.insertWithOnConflict(SQLiteDatabase.java:1646)
            at net.sqlcipher.database.SQLiteDatabase.insert(SQLiteDatabase.java:1506)
            at info.osom.sqlciphertest.MainActivity$PlaceholderFragment$1.onClick(MainActivity.java:75)
            at android.view.View.performClick(View.java:4202)
            at android.view.View$PerformClick.run(View.java:17340)
            at android.os.Handler.handleCallback(Handler.java:725)
            at android.os.Handler.dispatchMessage(Handler.java:92)
            at android.os.Looper.loop(Looper.java:137)
            at android.app.ActivityThread.main(ActivityThread.java:5039)
            at java.lang.reflect.Method.invokeNative(Native Method)
            at java.lang.reflect.Method.invoke(Method.java:511)
            at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:793)
            at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:560)
            at dalvik.system.NativeStart.main(Native Method)

Go check which version you're using and upgrade if required!