JAVA.HARDCODED.IP : Hardcoded IP Address (Java)

An occurrence or use of a hardcoded IP address.

There are two possible cases:

A hardcoded string matches a URI/URL format.

A method that takes a host/hostname parameter is passed a hardcoded value.
The none, loopback and broadcast IP addresses will not trigger warnings.

A warning of this class is not issued for a hardcoded string that matches IP address format unless there is evidence that the string is used as a host/hostname parameter.

Having a hardcoded IP address is considered a bad practice. It can lead to several problems:

When you have to change it, you must remember to change it in your code too.

You are forced to to use the same IP address in every environment the application is deployed into.

Some security protocols are now considered deprecated and unsafe and so, they must not be used.

プロパティ

クラス名

Hardcoded IP Address (Java)

日本語クラス名

Hardcoded IP Address (Java)

クラス分類

セキュリティ (security)

ニーモニック

JAVA.HARDCODED.IP

カテゴリー

CWE	CWE:547	Use of Hard-coded, Security-relevant Constants

対応言語

Java で利用可能です。

有効/無効設定

このワーニングクラスのチェックはデフォルトで無効になっています。チェックを有効にするにはプロジェクト設定ファイル（configuration file）に以下の WARNING_FILTER ルールを追加してください。

WARNING_FILTER += allow class="Hardcoded IP Address (Java)"

例

import java.net.MalformedURLException;
import java.net.URL;

public class HardCodedIPAddress { 

  public String http_IPv6;
        
  public void hardCoded_IP() throws MalformedURLException {

      http_IPv6 = "http://[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]:80/index.html"; // "Hardcoded IP Address (Java)" warning always issued here 

      String IPv6 = "[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]";                    // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=Yes 

      String broadcast = "255.255.255.255";                                                           // OK: broadcast IP 

      String loopback = "127.0.0.1";                                                                  // OK: loopback IP 

      String software_version = "9.0.3.1";                                          // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=Yes 
                                                                                    // - given the variable name, this is likely a false positive 

      String IPv4 = "192.88.11.2";                                                  // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=Yes 

      URL url1 = new URL("https",IPv4,80,"index.html");                             // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=No

      URL url2 = new URL("https",IPv4,80,"help.html");                              // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=No 

      string ftp_IPv4 = "ftp://192.88.11.3:3333";                                   // "Hardcoded IP Address (Java)" warning issued here when JAVA_ANALYSIS_PEDANTIC_MODE=Yes 

      URL url3 = new URL(ftp_IPv4);                                                 // "Hardcoded IP Address (Java)" warning issued here  when JAVA_ANALYSIS_PEDANTIC_MODE=No
  }
}

解決法

Parameterize it in a configuration file.

Use safer protocols.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。