import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.util.Base64;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;

public class SecretStore {

    // Base64 is an encoding, not encryption. Treating a Base64-"protected"
    // secret as confidential is unsafe: anyone who can read the stored form
    // can decode it straight back to the plaintext.
    String recoverSecret(String stored) {
        byte[] plain = Base64.getDecoder().decode(stored);   // 'Unsafe Base64 Encoding (Java)' warning issued here
        return new String(plain, StandardCharsets.UTF_8);
    }

    // The safe alternative is real encryption: AES in authenticated GCM mode
    // genuinely protects the secret, so recovering the plaintext requires the
    // secret key.
    String decryptSecret(SecretKey key, byte[] iv, byte[] ciphertext) throws GeneralSecurityException {
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.DECRYPT_MODE, key, new GCMParameterSpec(128, iv));
        byte[] plain = cipher.doFinal(ciphertext);           // ok: recovered with a real cipher and key
        return new String(plain, StandardCharsets.UTF_8);
    }
}

WARNING_FILTER += allow class="Unsafe Base64 Encoding (Java)"
JAVA_ANALYSIS_PEDANTIC_MODE = Yes
JAVA_ANALYSIS_ENTRY_POINTS_MODE = ALL_METHODS