Skip to content

Commit 57a0547

Browse files
author
Sakshis
committed
passwordauthentication-hardcoded-password-java
1 parent bed1a07 commit 57a0547

3 files changed

+171
-0
lines changed

‎rules/java/security/passwordauthentication-hardcoded-password-java.yml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
id: passwordauthentication-hardcoded-password-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798]: Use of Hard-coded Credentials
12+
[OWASP A05:2021]: Identification and Authentication Failures
13+
[REFERENCES]
14+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
utils:
16+
match_string_literal:
17+
kind: string_literal
18+
inside:
19+
stopBy: end
20+
kind: method_invocation
21+
all:
22+
- has:
23+
stopBy: end
24+
kind: identifier
25+
field: name
26+
regex: "^toCharArray$"
27+
- has:
28+
stopBy: end
29+
kind: argument_list
30+
field: arguments
31+
inside:
32+
stopBy: end
33+
kind: argument_list
34+
inside:
35+
stopBy: end
36+
kind: object_creation_expression
37+
has:
38+
stopBy: end
39+
kind: type_identifier
40+
field: type
41+
regex: "^PasswordAuthentication$"
42+
match_identifier_in_argumentlist:
43+
kind: identifier
44+
pattern: $ASDF
45+
inside:
46+
stopBy: end
47+
kind: argument_list
48+
has:
49+
stopBy: end
50+
kind: string_literal
51+
inside:
52+
stopBy: end
53+
kind: object_creation_expression
54+
has:
55+
stopBy: end
56+
kind: type_identifier
57+
field: type
58+
regex: "^PasswordAuthentication$"
59+
inside:
60+
stopBy: end
61+
kind: expression_statement
62+
follows:
63+
stopBy: end
64+
kind: local_variable_declaration
65+
all:
66+
- has:
67+
stopBy: end
68+
kind: array_type
69+
field: type
70+
all:
71+
- has:
72+
stopBy: end
73+
kind: integral_type
74+
field: element
75+
- has:
76+
stopBy: end
77+
kind: dimensions
78+
field: dimensions
79+
- has:
80+
stopBy: end
81+
kind: variable_declarator
82+
field: declarator
83+
all:
84+
- has:
85+
stopBy: end
86+
kind: identifier
87+
pattern: $ASDF
88+
- has:
89+
stopBy: end
90+
kind: method_invocation
91+
all:
92+
- has:
93+
stopBy: end
94+
kind: string_literal
95+
field: object
96+
- has:
97+
stopBy: end
98+
kind: identifier
99+
field: name
100+
regex: "^toCharArray$"
101+
- has:
102+
stopBy: end
103+
kind: argument_list
104+
field: arguments
105+
106+
rule:
107+
any:
108+
- matches: match_string_literal
109+
- matches: match_identifier_in_argumentlist

‎tests/__snapshots__/passwordauthentication-hardcoded-password-java-snapshot.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
id: passwordauthentication-hardcoded-password-java
2+
snapshots:
3+
? |
4+
import java.net.http.HttpRequest;
5+
import java.net.PasswordAuthentication;
6+
var authClient = HttpClient
7+
.newBuilder()
8+
.authenticator(new Authenticator() {
9+
@Override
10+
protected PasswordAuthentication getPasswordAuthentication() {
11+
new PasswordAuthentication("postman", "password".toCharArray());
12+
char[] asdf = "password".toCharArray()
13+
new PasswordAuthentication("postman", asdf);
14+
new PasswordAuthentication("postman", "password");
15+
}
16+
: labels:
17+
- source: '"password"'
18+
style: primary
19+
start: 264
20+
end: 274
21+
- source: toCharArray
22+
style: secondary
23+
start: 275
24+
end: 286
25+
- source: ()
26+
style: secondary
27+
start: 286
28+
end: 288
29+
- source: PasswordAuthentication
30+
style: secondary
31+
start: 230
32+
end: 252
33+
- source: new PasswordAuthentication("postman", "password".toCharArray())
34+
style: secondary
35+
start: 226
36+
end: 289
37+
- source: ("postman", "password".toCharArray())
38+
style: secondary
39+
start: 252
40+
end: 289
41+
- source: '"password".toCharArray()'
42+
style: secondary
43+
start: 264
44+
end: 288

‎tests/java/passwordauthentication-hardcoded-password-java-test.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: passwordauthentication-hardcoded-password-java
2+
valid:
3+
- |
4+
new PasswordAuthentication("postman", "password");
5+
invalid:
6+
- |
7+
import java.net.http.HttpRequest;
8+
import java.net.PasswordAuthentication;
9+
var authClient = HttpClient
10+
.newBuilder()
11+
.authenticator(new Authenticator() {
12+
@Override
13+
protected PasswordAuthentication getPasswordAuthentication() {
14+
new PasswordAuthentication("postman", "password".toCharArray());
15+
char[] asdf = "password".toCharArray()
16+
new PasswordAuthentication("postman", asdf);
17+
new PasswordAuthentication("postman", "password");
18+
}

0 commit comments

Comments
 (0)