JAVA.HARDCODED.PASSWD.FILE : Password in Property File (Java)

A password is retrieved from a property file.

Password manipulation can be risky, for instance if passwords are stored in plain in a property file. Moreover, passwords stored as program constants expose to the risk of inferring the password by simply looking at the binary executable of the code. This checker identifies situations when password manipulation is done in an unsafe way.

プロパティ

クラス名

Password in Property File (Java)

日本語クラス名

Password in Property File (Java)

クラス分類

セキュリティ (security)

ニーモニック

JAVA.HARDCODED.PASSWD.FILE

カテゴリー

CWE	CWE:522	Insufficiently Protected Credentials
OWASP-2017	OWASP-2017:A2	Broken authentication
OWASP-2021	OWASP-2021:A7	Identification and authorization failures

対応言語

Java で利用可能です。

有効/無効設定

このワーニングクラスのチェックはデフォルトで有効になっています。チェックを無効にするにはプロジェクト設定ファイル（configuration file）に以下の WARNING_FILTER ルールを追加してください。

WARNING_FILTER += discard class="Password in Property File (Java)"

例

import java.sql.DriverManager;
import java.sql.SQLException;
import java.util.Properties;

public class Passwords {
  private final static String pwd = "password";

  public void test(Properties props) throws SQLException {
      String s = "password";

      props.getProperty("password");                                   // Password in Property File (Java) warning issued here
      props.getProperty(pwd);                                          // Password in Property File (Java) warning issued here
      props.getProperty(s);                                            // Password in Property File (Java) warning issued here
      props.getProperty("www.juliasoft.password");                     // Password in Property File (Java) warning issued here
      props.getProperty("password", "default");                        // Password in Property File (Java) warning issued here
      props.getProperty("www.juliasoft.password", "default");          // Password in Property File (Java) warning issued here
      props.setProperty("com.julia.password", "goofy mouse");          // Hardcoded Password (Java) warning issued here
      props.setProperty("com.julia.password", s);                      // Hardcoded Password (Java) warning issued here
      props.setProperty("com.julia.password", s + " and " + pwd);
      DriverManager.getConnection("www.juliasoft.com", "silvio", pwd); // Hardcoded Password (Java) warning issued here
    }
}

解決法

Avoid storing passwords in property files and use encrypted files instead. Do not use program constants for passwords, store them in encrypted files instead.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。