C and C++


HARDCODED.DNS : Hardcoded DNS Name

Summary

A string literal in the code may be a hardcoded DNS name.

Properties

Class Name Hardcoded DNS Name
Significance security
Mnemonic HARDCODED.DNS
Categories
CWE CWE:506 Embedded Malicious Code
CERT-C CERT-C:MSC41-C Never hard code sensitive information
DISA-6r1 DISA-6r1:V-222612 The application must not be vulnerable to overflow attacks.
DISA-5r3 DISA-5r3:V-70277 The application must not be vulnerable to overflow attacks.
DISA-4r3 DISA-4r3:V-70277 The application must not be vulnerable to overflow attacks.
DISA-3r10 DISA-3r10:V-16804 The designer will ensure the application does not rely solely on a resource name to control access to a resource.
OWASP-2017 OWASP-2017:A6 Security misconfiguration
OWASP-2021 OWASP-2021:A5 Security misconfiguration
Availability Available for C and C++.
Enabling Checks for this warning class are disabled by default. To enable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += allow class="Hardcoded DNS Name"

Example

void connect_to_server(int port)
{
    char *servername = "www.example.com"; /* 'Hardcoded DNS Name' warning issued here */ 
    /* ... */          
}

Note

Warnings of this class may be reported as occurring in procedure #File_Initialization, reflecting language implementation details.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.