JAVA.HARDCODED.PASSWD : Hardcoded Password (Java)

Password manipulation can be risky, for instance if passwords are stored in plain in a property file. Moreover, passwords stored as program constants expose to the risk of inferring the password by simply looking at the binary executable of the code. This checker identifies situations when password manipulation is done in an unsafe way.

Properties

Examples

Example 1

import java.sql.DriverManager;
import java.sql.SQLException;
import java.util.Properties;

public class Passwords {
  private final static String pwd = "password";

  public void test(Properties props) throws SQLException {
      String s = "password";

      props.getProperty("password");                                   // Password in Property File (Java) warning issued here
      props.getProperty(pwd);                                          // Password in Property File (Java) warning issued here
      props.getProperty(s);                                            // Password in Property File (Java) warning issued here
      props.getProperty("www.juliasoft.password");                     // Password in Property File (Java) warning issued here
      props.getProperty("password", "default");                        // Password in Property File (Java) warning issued here
      props.getProperty("www.juliasoft.password", "default");          // Password in Property File (Java) warning issued here
      props.setProperty("com.julia.password", "goofy mouse");          // Hardcoded Password (Java) warning issued here
      props.setProperty("com.julia.password", s);                      // Hardcoded Password (Java) warning issued here
      props.setProperty("com.julia.password", s + " and " + pwd);
      DriverManager.getConnection("www.juliasoft.com", "silvio", pwd); // Hardcoded Password (Java) warning issued here
    }
}

Example 2

public PasswordPropagation {

  public void checkPassword(String password) {
      if (password.trim().equals("SpidermanIsTheBest")) {
          System.out.println("Hi Peter!");
          savePassword(password.trim());        // "Hardcoded Password (Java)" warning issued here
      }

      if (password.substring(1).equals("BlackPearl")) {
          System.out.println("Hi Jack!");
          savePassword(password.substring(1));  // "Hardcoded Password (Java)" warning issued here
      }
  }

  private void savePassword(String v) {
      // ...
  }
}

Resolution

Avoid storing passwords in property files and use encrypted files instead. Do not use program constants for passwords, store them in encrypted files instead.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.