JAVA.HARDCODED.IP : Hardcoded IP Address (Java)

An occurrence or use of a hardcoded IP address or URL/URI.

Warning locations for this warning class depend on the setting of JAVA_ANALYSIS_PEDANTIC_MODE.

JAVA_ANALYSIS_PEDANTIC_MODE=Yes	A warning is issued when a method that takes a host/hostname parameter is passed a hardcoded value that matches IP address or URI/URL format. A warning is not issued for a hardcoded string that matches IP address format unless there is evidence that the string is used as a host/hostname parameter.
JAVA_ANALYSIS_PEDANTIC_MODE=No	A warning is issued for each string literal that that matches IP address or URI/URL format. There is no requirement that the string be used in a specific context, or even that it be used at all.

JAVA_ANALYSIS_PEDANTIC_MODE=Yes

A warning is issued when a method that takes a host/hostname parameter is passed a hardcoded value that matches IP address or URI/URL format.
A warning is not issued for a hardcoded string that matches IP address format unless there is evidence that the string is used as a host/hostname parameter.

JAVA_ANALYSIS_PEDANTIC_MODE=No

A warning is issued for each string literal that that matches IP address or URI/URL format.
There is no requirement that the string be used in a specific context, or even that it be used at all.

Having a hardcoded IP address is considered a bad practice. It can lead to several problems:

When you have to change it, you must remember to change it in your code too.

You are forced to to use the same IP address in every environment the application is deployed into.

Some security protocols are now considered deprecated and unsafe and so, they must not be used.

Properties

Class Name

Hardcoded IP Address (Java)

Significance

security

Mnemonic

JAVA.HARDCODED.IP

Categories

CWE	CWE:547	Use of Hard-coded, Security-relevant Constants

Availability

Available for Java only.

Enabling

Checks for this warning class are disabled by default. To enable them, add the following WARNING_FILTER rule to the project configuration file.

WARNING_FILTER += allow class="Hardcoded IP Address (Java)"

Example

import java.net.MalformedURLException;
import java.net.URL;

public class HardCodedIPAddress { 

  public String http_IPv6;
        
  public void hardCoded_IP() throws MalformedURLException {

      http_IPv6 = "http://[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]:80/index.html"; // "Hardcoded IP Address (Java)" warning always issued here 

      String IPv6 = "[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]";                    // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=Yes 

      String broadcast = "255.255.255.255";                                                           // OK: broadcast IP 

      String loopback = "127.0.0.1";                                                                  // OK: loopback IP 

      String software_version = "9.0.3.1";                                          // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=Yes 
                                                                                    // - given the variable name, this is likely a false positive 

      String IPv4 = "192.88.11.2";                                                  // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=Yes 

      URL url1 = new URL("https",IPv4,80,"index.html");                             // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=No

      URL url2 = new URL("https",IPv4,80,"help.html");                              // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=No 

      string ftp_IPv4 = "ftp://192.88.11.3:3333";                                   // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=Yes 

      URL url3 = new URL(ftp_IPv4);                                                 // "Hardcoded IP Address (Java)" warning issued here  when JAVA_ANALYSIS_PEDANTIC_MODE=No
  }
}

Resolution

Parameterize IP addresses and URLs/URIs in a configuration file.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.