C#

CSHARP.HARDCODED.IP : Hardcoded IP Address (C#)

Summary

An occurrence or use of a hardcoded IP address or URL/URI.

Warning locations for this warning class depend on the setting of CSHARP_ANALYSIS_PEDANTIC_MODE.

CSHARP_ANALYSIS_PEDANTIC_MODE=Yes A warning is issued when a method that takes a host/hostname parameter is passed a hardcoded value that matches IP address or URI/URL format.
A warning is not issued for a hardcoded string that matches IP address format unless there is evidence that the string is used as a host/hostname parameter.
CSHARP_ANALYSIS_PEDANTIC_MODE=No A warning is issued for each string literal that that matches IP address or URI/URL format.
There is no requirement that the string be used in a specific context, or even that it be used at all.

Having a hardcoded IP address is considered a bad practice. It can lead to several problems:

Some security protocols are now considered deprecated and unsafe and so, they must not be used.

Properties

Class Name Hardcoded IP Address (C#)
Significance security
Mnemonic CSHARP.HARDCODED.IP
Categories
CWE CWE:547 Use of Hard-coded, Security-relevant Constants
Availability Available for C# only.
Enabling Checks for this warning class are disabled by default. To enable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += allow class="Hardcoded IP Address (C#)"

Example 

using System;
using System.Net;


namespace HardCodedIPAddressExamples
{

  public class HardCodedIPAddress
  {

    public string http_IPv6;

    public void HardCoded_IP() {

      http_IPv6 = "http://[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]:80/index.html"; // "Hardcoded IP Address (C#)" warning always issued here

      string IPv6 = "[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]"; // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=Yes

      string broadcast = "255.255.255.255";                        // OK: broadcast IP

      string loopback = "127.0.0.1";                               // OK: loopback IP

      string software_version = "9.0.3.1";              // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=Yes
                                                        // - given the variable name, this is likely a false positive

      string IPv4 = "192.88.11.2";                      // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=Yes

      TcpClient client_tcp = new TcpClient(IPv4, 2222); // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=No

      UdpClient client_udp = new UdpClient(IPv4, 2223); // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=No

      string ftp_IPv4 = "ftp://192.88.11.3:3333";       // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=Yes

      Uri uri = new Uri(ftp_IPv4);                      // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=No

    }

  }
}

Resolution

Parameterize it in a configuration file.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.