C#

CSHARP.HARDCODED.IP : Hardcoded IP Address (C#)

要旨

An occurrence or use of a hardcoded IP address or URL/URI.

Warning locations for this warning class depend on the setting of CSHARP_ANALYSIS_PEDANTIC_MODE.

CSHARP_ANALYSIS_PEDANTIC_MODE=Yes A warning is issued when a method that takes a host/hostname parameter is passed a hardcoded value that matches IP address or URI/URL format.
A warning is not issued for a hardcoded string that matches IP address format unless there is evidence that the string is used as a host/hostname parameter.
CSHARP_ANALYSIS_PEDANTIC_MODE=No A warning is issued for each string literal that that matches IP address or URI/URL format.
There is no requirement that the string be used in a specific context, or even that it be used at all.

プロパティ

クラス名 Hardcoded IP Address (C#)
日本語クラス名 Hardcoded IP Address (C#)
クラス分類 セキュリティ (security)
ニーモニック CSHARP.HARDCODED.IP
カテゴリー
CWE CWE:547 Use of Hard-coded, Security-relevant Constants
対応言語 C# で利用可能です。
有効/無効設定 このワーニングクラスのチェックはデフォルトで無効になっています。チェックを有効にするにはプロジェクト設定ファイル （configuration file）に以下の WARNING_FILTER ルールを追加してください。 
WARNING_FILTER += allow class="Hardcoded IP Address (C#)"

例 

using System;
using System.Net;


namespace HardCodedIPAddressExamples
{

  public class HardCodedIPAddress
  {

    public string http_IPv6;

    public void HardCoded_IP() {

      http_IPv6 = "http://[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]:80/index.html"; // "Hardcoded IP Address (C#)" warning always issued here

      string IPv6 = "[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]"; // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=Yes

      string broadcast = "255.255.255.255";                        // OK: broadcast IP

      string loopback = "127.0.0.1";                               // OK: loopback IP

      string software_version = "9.0.3.1";              // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=Yes
                                                        // - given the variable name, this is likely a false positive

      string IPv4 = "192.88.11.2";                      // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=Yes

      TcpClient client_tcp = new TcpClient(IPv4, 2222); // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=No

      UdpClient client_udp = new UdpClient(IPv4, 2223); // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=No

      string ftp_IPv4 = "ftp://192.88.11.3:3333";       // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=Yes

      Uri uri = new Uri(ftp_IPv4);                      // "Hardcoded IP Address (C#)" warning issued here when CSHARP_ANALYSIS_PEDANTIC_MODE=No

    }

  }
}

解決法

Parameterize it in a configuration file.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。